The read_gab2_sub function in libavformat/avidec.c in FFmpeg before 3.1.4 allows remote attackers to cause a denial of service (NULL pointer used) via a crafted AVI file.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Integer overflow in the mov_build_index function in libavformat/mov.c in FFmpeg before 2.8.8, 3.0.x before
    3.0.3 and 3.1.x before 3.1.1 allows remote attackers to have unspecified impact via vectors involving
    sample size. (CVE-2016-6164)

  - An off by one error resulting in an allocation of zero size in FFmpeg in Google Chrome prior to
    54.0.2840.98 for Mac, and 54.0.2840.99 for Windows, and 54.0.2840.100 for Linux, and 55.0.2883.84 for
    Android allowed a remote attacker to potentially exploit heap corruption via a crafted video file.
    (CVE-2016-5199)

  - The zlib_refill function in libavformat/swfdec.c in FFmpeg before 3.1.3 allows remote attackers to cause
    an infinite loop denial of service via a crafted SWF file. (CVE-2016-6881)

  - The avi_read_nikon function in libavformat/avidec.c in FFmpeg before 3.1.4 is vulnerable to infinite loop
    when it decodes an AVI file that has a crafted 'nctg' structure. (CVE-2016-7122)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Integer overflow in the mov_build_index function in libavformat/mov.c in FFmpeg before 2.8.8, 3.0.x before
    3.0.3 and 3.1.x before 3.1.1 allows remote attackers to have unspecified impact via vectors involving
    sample size. (CVE-2016-6164)

  - The jpeg2000_decode_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.8.6 allows remote
    attackers to cause a denial of service (out-of-bounds array read access) via crafted JPEG 2000 data.
    (CVE-2016-2213)

  - libswscale/swscale_unscaled.c in FFmpeg before 2.8.6 does not validate certain height values, which allows
    remote attackers to cause a denial of service (out-of-bounds array read access) or possibly have
    unspecified other impact via a crafted .cine file, related to the bayer_to_rgb24_wrapper and
    bayer_to_yv12_wrapper functions. (CVE-2016-2328)

  - libavcodec/tiff.c in FFmpeg before 2.8.6 does not properly validate RowsPerStrip values and YCbCr
    chrominance subsampling factors, which allows remote attackers to cause a denial of service (out-of-bounds
    array access) or possibly have unspecified other impact via a crafted TIFF file, related to the
    tiff_decode_tag and decode_frame functions. (CVE-2016-2329)

  - libavcodec/gif.c in FFmpeg before 2.8.6 does not properly calculate a buffer size, which allows remote
    attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other
    impact via a crafted .tga file, related to the gif_image_write_image, gif_encode_init, and
    gif_encode_close functions. (CVE-2016-2330)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Integer overflow in the mov_build_index function in libavformat/mov.c in FFmpeg before 2.8.8, 3.0.x before
    3.0.3 and 3.1.x before 3.1.1 allows remote attackers to have unspecified impact via vectors involving
    sample size. (CVE-2016-6164)

  - The zlib_refill function in libavformat/swfdec.c in FFmpeg before 3.1.3 allows remote attackers to cause
    an infinite loop denial of service via a crafted SWF file. (CVE-2016-6881)

  - The avi_read_nikon function in libavformat/avidec.c in FFmpeg before 3.1.4 is vulnerable to infinite loop
    when it decodes an AVI file that has a crafted 'nctg' structure. (CVE-2016-7122)

  - The ff_log2_16bit_c function in libavutil/intmath.h in FFmpeg before 3.1.4 is vulnerable to reading out-
    of-bounds memory when it decodes a malformed AIFF file. (CVE-2016-7450)

The remote host is affected by the vulnerability described in GLSA-201701-71 (FFmpeg: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in FFmpeg. Please review       the CVE identifiers referenced below for details.
  Impact :

    Remote attackers could cause a Denial of Service condition via various       crafted media file types or have other unspecified impacts.
  Workaround :

    There is no known workaround at this time.

This update for ffmpeg fixes multiple security issues in ffmpeg (boo#1003806)

These vulnerabilities can be triggered when processing specially crafted avi video content, and could lead to crashes or have unspecified further impact including potential code execution.

  - CVE-2016-7562: out-of-bounds array write fault via     specially crafted avi files

  - CVE-2016-7502: out-of-bounds array write via incorrect     block values

  - CVE-2016-7905: null-point-exception when decoding avi     files with crafted 'gab2' structs

  - CVE-2016-7555: memory leak when decoding avi files with     crafted 'strh' struct

  - CVE-2016-7785: assert fault via avi files with crafted     'strh' struct

ID	Name	Product	Family	Severity
404290	Alpine: multiple ffmpeg packages: security update to 3.0.7-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
404290	Alpine: multiple ffmpeg packages: security update to 3.0.7-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
404289	Alpine: multiple ffmpeg packages: security update to 2.8.11-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
404289	Alpine: multiple ffmpeg packages: security update to 2.8.11-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
400952	Alpine: ffmpeg2.8: security update to 2.8.7-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
400952	Alpine: ffmpeg2.8: security update to 2.8.7-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
96857	GLSA-201701-71 : FFmpeg: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
94129	openSUSE Security Update : ffmpeg (openSUSE-2016-1203)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2016-7905

medium

Tenable Plugins

critical

critical

critical

critical

critical

critical

high

high