Heap-based buffer overflow in the decode_dds1 function in libavcodec/dfa.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Heap-based buffer overflow in the decode_dds1 function in libavcodec/dfa.c in FFmpeg before 2.8.12, 3.0.x     before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 allows remote attackers to     cause a denial of service (application crash) or possibly have unspecified other impact via a crafted     file. (CVE-2017-9992)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Heap-based buffer overflow in the xwd_decode_frame function in libavcodec/xwddec.c in FFmpeg before
    2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 allows remote
    attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a
    crafted file. (CVE-2017-9991)

  - Heap-based buffer overflow in the decode_dds1 function in libavcodec/dfa.c in FFmpeg before 2.8.12, 3.0.x
    before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 allows remote attackers to
    cause a denial of service (application crash) or possibly have unspecified other impact via a crafted
    file. (CVE-2017-9992)

  - libavcodec/webp.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and
    3.3.x before 3.3.1 does not ensure that pix_fmt is set, which allows remote attackers to cause a denial of
    service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a
    crafted file, related to the vp8_decode_mb_row_no_filter and pred8x8_128_dc_8_c functions. (CVE-2017-9994)

  - The cdxl_decode_frame function in libavcodec/cdxl.c in FFmpeg 2.8.x before 2.8.12, 3.0.x before 3.0.8,
    3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 does not exclude the CHUNKY format, which
    allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or
    possibly have unspecified other impact via a crafted file. (CVE-2017-9996)

Several security issues have been corrected in multiple demuxers and decoders of the libav multimedia library. A full list of the changes is available at https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11 .11

Multiple vulnerabilities have been found in libav :

CVE-2015-8365

The smka_decode_frame function in libavcodec/smacker.c does not verify that the data size is consistent with the number of channels, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Smacker data.

CVE-2017-7208

The decode_residual function in libavcodec allows remote attackers to cause a denial of service (buffer over-read) or obtain sensitive information from process memory via a crafted h264 video file.

CVE-2017-7862

The decode_frame function in libavcodec/pictordec.c is vulnerable to an out-of-bounds write caused by a heap-based buffer overflow.

CVE-2017-9992

The decode_dds1 function in libavcodec/dfa.c allows remote attackers to cause a denial of service (Heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.

For Debian 7 'Wheezy', these problems have been fixed in version 6:0.8.21-0+deb7u1.

We recommend that you upgrade your libav packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
254633	Linux Distros Unpatched Vulnerability : CVE-2017-9992	Nessus	Misc.	high
404298	Alpine: multiple ffmpeg packages: security update to 3.2.5-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
404298	Alpine: multiple ffmpeg packages: security update to 3.2.5-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
404295	Alpine: multiple ffmpeg packages: security update to 3.1.8-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
404295	Alpine: multiple ffmpeg packages: security update to 3.1.8-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
104302	Debian DSA-4012-1 : libav - security update	Nessus	Debian Local Security Checks	critical
104056	Debian DLA-1142-1 : libav security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2017-9992

high

Tenable Plugins

high

high

high

high

high

critical

critical