The avi_read_header function in libavformat/avidec.c in FFmpeg before 3.1.4 is vulnerable to memory leak when decoding an AVI file that has a crafted "strh" structure.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Integer overflow in the mov_build_index function in libavformat/mov.c in FFmpeg before 2.8.8, 3.0.x before
    3.0.3 and 3.1.x before 3.1.1 allows remote attackers to have unspecified impact via vectors involving
    sample size. (CVE-2016-6164)

  - An off by one error resulting in an allocation of zero size in FFmpeg in Google Chrome prior to
    54.0.2840.98 for Mac, and 54.0.2840.99 for Windows, and 54.0.2840.100 for Linux, and 55.0.2883.84 for
    Android allowed a remote attacker to potentially exploit heap corruption via a crafted video file.
    (CVE-2016-5199)

  - The zlib_refill function in libavformat/swfdec.c in FFmpeg before 3.1.3 allows remote attackers to cause
    an infinite loop denial of service via a crafted SWF file. (CVE-2016-6881)

  - The avi_read_nikon function in libavformat/avidec.c in FFmpeg before 3.1.4 is vulnerable to infinite loop
    when it decodes an AVI file that has a crafted 'nctg' structure. (CVE-2016-7122)

The remote host is affected by the vulnerability described in GLSA-201701-71 (FFmpeg: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in FFmpeg. Please review       the CVE identifiers referenced below for details.
  Impact :

    Remote attackers could cause a Denial of Service condition via various       crafted media file types or have other unspecified impacts.
  Workaround :

    There is no known workaround at this time.

This update for ffmpeg fixes multiple security issues in ffmpeg (boo#1003806)

These vulnerabilities can be triggered when processing specially crafted avi video content, and could lead to crashes or have unspecified further impact including potential code execution.

  - CVE-2016-7562: out-of-bounds array write fault via     specially crafted avi files

  - CVE-2016-7502: out-of-bounds array write via incorrect     block values

  - CVE-2016-7905: null-point-exception when decoding avi     files with crafted 'gab2' structs

  - CVE-2016-7555: memory leak when decoding avi files with     crafted 'strh' struct

  - CVE-2016-7785: assert fault via avi files with crafted     'strh' struct

ID	Name	Product	Family	Severity
404290	Alpine: multiple ffmpeg packages: security update to 3.0.7-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
404290	Alpine: multiple ffmpeg packages: security update to 3.0.7-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
96857	GLSA-201701-71 : FFmpeg: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
94129	openSUSE Security Update : ffmpeg (openSUSE-2016-1203)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2016-7555

medium

Tenable Plugins

critical

critical

high

high