The dnxhd decoder in FFmpeg before 3.2.6, and 3.3.x before 3.3.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted mov file.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - The dnxhd decoder in FFmpeg before 3.2.6, and 3.3.x before 3.3.3 allows remote attackers to cause a denial
    of service (NULL pointer dereference) via a crafted mov file. (CVE-2017-9608)

  - FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not
    properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to
    read arbitrary files via crafted playlist data. (CVE-2017-9993)

Several vulnerabilities have been discovered in FFmpeg, a multimedia player, server and encoder. These issues could lead to Denial-of-Service and, in some situation, the execution of arbitrary code.

  - CVE-2017-9608     Yihan Lian of Qihoo 360 GearTeam discovered a NULL     pointer access when parsing a crafted MOV file.

  - CVE-2017-9993     Thierry Foucu discovered that it was possible to leak     information from files and symlinks ending in common     multimedia extensions, using the HTTP Live Streaming.

  - CVE-2017-11399     Liu Bingchang of IIE discovered an integer overflow in     the APE decoder that can be triggered by a crafted APE     file.

  - CVE-2017-11665     JunDong Xie of Ant-financial Light-Year Security Lab     discovered that an attacker able to craft a RTMP stream     can crash FFmpeg.

  - CVE-2017-11719     Liu Bingchang of IIE discovered an out-of-bound access     that can be triggered by a crafted DNxHD file.

ID	Name	Product	Family	Severity
404299	Alpine: multiple ffmpeg packages: security update to 3.2.6-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
404299	Alpine: multiple ffmpeg packages: security update to 3.2.6-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
102807	Debian DSA-3957-1 : ffmpeg - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-9608

medium

Tenable Plugins

high

high

high