DSA-3957

100017

https://github.com/FFmpeg/FFmpeg/commit/ffcc82219cef0928bed2d558b19ef6ea35634130

Several vulnerabilities have been discovered in FFmpeg, a multimedia player, server and encoder. These issues could lead to Denial-of-Service and, in some situation, the execution of arbitrary code.

  - CVE-2017-9608     Yihan Lian of Qihoo 360 GearTeam discovered a NULL     pointer access when parsing a crafted MOV file.

  - CVE-2017-9993     Thierry Foucu discovered that it was possible to leak     information from files and symlinks ending in common     multimedia extensions, using the HTTP Live Streaming.

  - CVE-2017-11399     Liu Bingchang of IIE discovered an integer overflow in     the APE decoder that can be triggered by a crafted APE     file.

  - CVE-2017-11665     JunDong Xie of Ant-financial Light-Year Security Lab     discovered that an attacker able to craft a RTMP stream     can crash FFmpeg.

  - CVE-2017-11719     Liu Bingchang of IIE discovered an out-of-bound access     that can be triggered by a crafted DNxHD file.

CVE-2017-11665

high

Tenable Plugins

high