FFmpeg before 2017-02-07 has an out-of-bounds write caused by a heap-based buffer overflow related to the decode_frame function in libavcodec/pictordec.c.

The remote host is affected by the vulnerability described in GLSA-201811-19 (Libav: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Libav. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker, via a crafted Smacker stream, could cause a Denial of       Service condition.
  Workaround :

    There is no known workaround at this time.

Several security issues have been corrected in multiple demuxers and decoders of the libav multimedia library. A full list of the changes is available at https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11 .11

Multiple vulnerabilities have been found in libav :

CVE-2015-8365

The smka_decode_frame function in libavcodec/smacker.c does not verify that the data size is consistent with the number of channels, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Smacker data.

CVE-2017-7208

The decode_residual function in libavcodec allows remote attackers to cause a denial of service (buffer over-read) or obtain sensitive information from process memory via a crafted h264 video file.

CVE-2017-7862

The decode_frame function in libavcodec/pictordec.c is vulnerable to an out-of-bounds write caused by a heap-based buffer overflow.

CVE-2017-9992

The decode_dds1 function in libavcodec/dfa.c allows remote attackers to cause a denial of service (Heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.

For Debian 7 'Wheezy', these problems have been fixed in version 6:0.8.21-0+deb7u1.

We recommend that you upgrade your libav packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for ffmpeg to version 3.3 fixes several issues.

These security issues were fixed :

  - CVE-2016-10190: Heap-based buffer overflow in     libavformat/http.c in FFmpeg allowed remote web servers     to execute arbitrary code via a negative chunk size in     an HTTP response (boo#1022920)

  - CVE-2016-10191: Heap-based buffer overflow in     libavformat/rtmppkt.c in FFmpeg allowed remote attackers     to execute arbitrary code by leveraging failure to check     for RTMP packet size mismatches (boo#1022921)

  - CVE-2016-10192: Heap-based buffer overflow in ffserver.c     in FFmpeg allowed remote attackers to execute arbitrary     code by leveraging failure to check chunk size     (boo#1022922)

  - CVE-2017-7859: FFmpeg had an out-of-bounds write caused     by a heap-based buffer overflow related to the     ff_h264_slice_context_init function in     libavcodec/h264dec.c (bsc#1034183).

  - CVE-2017-7862: FFmpeg had an out-of-bounds write caused     by a heap-based buffer overflow related to the     decode_frame function in libavcodec/pictordec.c     (bsc#1034181).

  - CVE-2017-7863: FFmpeg had an out-of-bounds write caused     by a heap-based buffer overflow related to the     decode_frame_common function in libavcodec/pngdec.c     (boo#1034179)

  - CVE-2017-7865: FFmpeg had an out-of-bounds write caused     by a heap-based buffer overflow related to the     ipvideo_decode_block_opcode_0xA function in     libavcodec/interplayvideo.c and the     avcodec_align_dimensions2 function in libavcodec/utils.c     (boo#1034177)

  - CVE-2017-7866: FFmpeg had an out-of-bounds write caused     by a stack-based buffer overflow related to the     decode_zbuf function in libavcodec/pngdec.c     (boo#1034176)

These non-security issues were fixed :

  - Enable ac3 

  - Enable mp3 decoding

  - EBU R128 implementation now within ffmpeg, not relying     on external library anymore

  - New video filters 'premultiply', 'readeia608',     'threshold', 'midequalizer'

  - Support for spherical videos

  - New decoders: 16.8 and 24.0 floating point PCM, XPM

  - New demuxers: MIDI Sample Dump Standard, Sample Dump     eXchange demuxer

  - MJPEG encoding uses Optimal Huffman tables now

  - Native Opus encoder

  - Support .mov with multiple sample description tables

  - Removed the legacy X11 screen grabber, use XCB instead

  - Removed asyncts filter (use af_aresample instead)

ID	Name	Product	Family	Severity
119164	GLSA-201811-19 : Libav: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
104302	Debian DSA-4012-1 : libav - security update	Nessus	Debian Local Security Checks	critical
104056	Debian DLA-1142-1 : libav security update	Nessus	Debian Local Security Checks	critical
99722	openSUSE Security Update : ffmpeg (openSUSE-2017-524)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2017-7862

critical

Tenable Plugins

critical

critical

critical

critical