In Libav through 11.11 and 12.x through 12.1, the smacker_decode_tree function in libavcodec/smacker.c does not properly restrict tree recursion, which allows remote attackers to cause a denial of service (bitstream.c:build_table() out-of-bounds read and application crash) via a crafted Smacker stream.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Libav through 11.11 and 12.x through 12.1, the smacker_decode_tree function in libavcodec/smacker.c     does not properly restrict tree recursion, which allows remote attackers to cause a denial of service     (bitstream.c:build_table() out-of-bounds read and application crash) via a crafted Smacker stream.
    (CVE-2017-16803)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-201811-19 (Libav: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Libav. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker, via a crafted Smacker stream, could cause a Denial of       Service condition.
  Workaround :

    There is no known workaround at this time.

Several security issues have been corrected in multiple demuxers and decoders of the libav multimedia library. A full list of the changes is available at https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11 .12

ID	Name	Product	Family	Severity
255495	Linux Distros Unpatched Vulnerability : CVE-2017-16803	Nessus	Misc.	high
119164	GLSA-201811-19 : Libav: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
106877	Debian DSA-4119-1 : libav - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-16803

high

Tenable Plugins

high

critical

high