CVE-2016-10192

Опубликовано: 09 фев. 2017

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Средний

Описание

Heap-based buffer overflow in ffserver.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote attackers to execute arbitrary code by leveraging failure to check chunk size.

Ссылки

http://www.openwall.com/lists/oss-security/2017/01/31/12
Mailing List
Patch
Third Party Advisory
http://www.openwall.com/lists/oss-security/2017/02/02/1
Mailing List
Patch
Third Party Advisory
http://www.securityfocus.com/bid/95991
Third Party Advisory
VDB Entry
https://ffmpeg.org/security.html
Release Notes
Vendor Advisory
https://github.com/FFmpeg/FFmpeg/commit/a5d25faa3f4b18dac737fdb35d0dd68eb0dc2156
Patch
http://www.openwall.com/lists/oss-security/2017/01/31/12
Mailing List
Patch
Third Party Advisory
http://www.openwall.com/lists/oss-security/2017/02/02/1
Mailing List
Patch
Third Party Advisory
http://www.securityfocus.com/bid/95991
Third Party Advisory
VDB Entry
https://ffmpeg.org/security.html
Release Notes
Vendor Advisory
https://github.com/FFmpeg/FFmpeg/commit/a5d25faa3f4b18dac737fdb35d0dd68eb0dc2156
Patch

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*

Версия до 2.8.9 (включая)

cpe:2.3:a:ffmpeg:ffmpeg:3.0:*:*:*:*:*:*:*

cpe:2.3:a:ffmpeg:ffmpeg:3.0.1:*:*:*:*:*:*:*

cpe:2.3:a:ffmpeg:ffmpeg:3.0.2:*:*:*:*:*:*:*

cpe:2.3:a:ffmpeg:ffmpeg:3.0.3:*:*:*:*:*:*:*

cpe:2.3:a:ffmpeg:ffmpeg:3.0.4:*:*:*:*:*:*:*

cpe:2.3:a:ffmpeg:ffmpeg:3.1:*:*:*:*:*:*:*

cpe:2.3:a:ffmpeg:ffmpeg:3.1.1:*:*:*:*:*:*:*

cpe:2.3:a:ffmpeg:ffmpeg:3.1.2:*:*:*:*:*:*:*

cpe:2.3:a:ffmpeg:ffmpeg:3.1.3:*:*:*:*:*:*:*

cpe:2.3:a:ffmpeg:ffmpeg:3.1.4:*:*:*:*:*:*:*

cpe:2.3:a:ffmpeg:ffmpeg:3.1.5:*:*:*:*:*:*:*

cpe:2.3:a:ffmpeg:ffmpeg:3.2:*:*:*:*:*:*:*

cpe:2.3:a:ffmpeg:ffmpeg:3.2.1:*:*:*:*:*:*:*

EPSS

Процентиль: 94%

0.12513

Средний

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-119

Связанные уязвимости

CVE-2016-10192

CVSS3: 9.8

ubuntu

почти 9 лет назад

CVE-2016-10192

CVSS3: 9.8

debian

почти 9 лет назад

Heap-based buffer overflow in ffserver.c in FFmpeg before 2.8.10, 3.0. ...

GHSA-gmhg-h539-229j

CVSS3: 9.8

github

больше 3 лет назад

BDU:2017-01538

fstec

почти 9 лет назад

Уязвимость мультимедийной библиотеки FFmpeg, позволяющая нарушителю выполнить произвольный код

openSUSE-SU-2017:1433-1

suse-cvrf

больше 8 лет назад

Security update for ffmpeg2

EPSS

Процентиль: 94%

0.12513

Средний

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-119