Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2017-9996

The cdxl_decode_frame function in libavcodec/cdxl.c in FFmpeg 2.8.x before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 does not exclude the CHUNKY format, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.

Published

2017-06-28T06:29:00.613

Last Modified

2025-04-20T01:37:25.860

Status

Deferred

Source

[email protected]

Severity

CVSSv3.0: 7.8 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

8.6

Impact Score

6.4

Weaknesses

Type: Primary
CWE-119

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	ffmpeg	ffmpeg	2.8	Yes
Application	ffmpeg	ffmpeg	2.8.1	Yes
Application	ffmpeg	ffmpeg	2.8.2	Yes
Application	ffmpeg	ffmpeg	2.8.3	Yes
Application	ffmpeg	ffmpeg	2.8.4	Yes
Application	ffmpeg	ffmpeg	2.8.5	Yes
Application	ffmpeg	ffmpeg	2.8.6	Yes
Application	ffmpeg	ffmpeg	2.8.7	Yes
Application	ffmpeg	ffmpeg	2.8.8	Yes
Application	ffmpeg	ffmpeg	2.8.9	Yes
Application	ffmpeg	ffmpeg	2.8.10	Yes
Application	ffmpeg	ffmpeg	2.8.11	Yes
Application	ffmpeg	ffmpeg	3.0	Yes
Application	ffmpeg	ffmpeg	3.0.1	Yes
Application	ffmpeg	ffmpeg	3.0.2	Yes
Application	ffmpeg	ffmpeg	3.0.3	Yes
Application	ffmpeg	ffmpeg	3.0.4	Yes
Application	ffmpeg	ffmpeg	3.0.5	Yes
Application	ffmpeg	ffmpeg	3.0.6	Yes
Application	ffmpeg	ffmpeg	3.0.7	Yes
Application	ffmpeg	ffmpeg	3.1	Yes
Application	ffmpeg	ffmpeg	3.1.1	Yes
Application	ffmpeg	ffmpeg	3.1.2	Yes
Application	ffmpeg	ffmpeg	3.1.3	Yes
Application	ffmpeg	ffmpeg	3.1.4	Yes
Application	ffmpeg	ffmpeg	3.1.5	Yes
Application	ffmpeg	ffmpeg	3.1.6	Yes
Application	ffmpeg	ffmpeg	3.1.7	Yes
Application	ffmpeg	ffmpeg	3.2	Yes
Application	ffmpeg	ffmpeg	3.2.1	Yes
Application	ffmpeg	ffmpeg	3.2.2	Yes
Application	ffmpeg	ffmpeg	3.2.3	Yes
Application	ffmpeg	ffmpeg	3.2.4	Yes
Application	ffmpeg	ffmpeg	3.3	Yes

References

http://www.securityfocus.com/bid/99323 Third Party Advisory, VDB Entry ([email protected])
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1378 Issue Tracking, Third Party Advisory ([email protected])
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1427 Issue Tracking, Third Party Advisory ([email protected])
https://github.com/FFmpeg/FFmpeg/commit/1e42736b95065c69a7481d0cf55247024f54b660 Issue Tracking, Patch, Third Party Advisory ([email protected])
https://github.com/FFmpeg/FFmpeg/commit/e1b60aad77c27ed5d4dfc11e5e6a05a38c70489d Issue Tracking, Patch, Third Party Advisory ([email protected])
http://www.securityfocus.com/bid/99323 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1378 Issue Tracking, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1427 Issue Tracking, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/FFmpeg/FFmpeg/commit/1e42736b95065c69a7481d0cf55247024f54b660 Issue Tracking, Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/FFmpeg/FFmpeg/commit/e1b60aad77c27ed5d4dfc11e5e6a05a38c70489d Issue Tracking, Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)