exploitDog

CVE-2017-9992

Опубликовано: 28 июн. 2017

Источник: nvd

CVSS3: 8.8

CVSS2: 6.8

EPSS Низкий

Описание

Heap-based buffer overflow in the decode_dds1 function in libavcodec/dfa.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file.

Ссылки

http://www.debian.org/security/2017/dsa-4012
Third Party Advisory
http://www.securityfocus.com/bid/99319
Third Party Advisory
VDB Entry
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1345
Issue Tracking
Third Party Advisory
https://github.com/FFmpeg/FFmpeg/commit/f52fbf4f3ed02a7d872d8a102006f29b4421f360
Issue Tracking
Patch
Third Party Advisory
http://www.debian.org/security/2017/dsa-4012
Third Party Advisory
http://www.securityfocus.com/bid/99319
Third Party Advisory
VDB Entry
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1345
Issue Tracking
Third Party Advisory
https://github.com/FFmpeg/FFmpeg/commit/f52fbf4f3ed02a7d872d8a102006f29b4421f360
Issue Tracking
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*

Версия до 2.8.12 (исключая)

cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*

Версия от 3.0 (включая) до 3.0.8 (исключая)

cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*

Версия от 3.1 (включая) до 3.1.8 (исключая)

cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*

Версия от 3.2 (включая) до 3.2.5 (исключая)

cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*

Версия от 3.3 (включая) до 3.3.1 (исключая)

Конфигурация 2

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

EPSS

Процентиль: 72%

0.00699

Низкий

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-119

Связанные уязвимости

CVE-2017-9992

CVSS3: 8.8

ubuntu

больше 8 лет назад

Heap-based buffer overflow in the decode_dds1 function in libavcodec/dfa.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file.

CVE-2017-9992

CVSS3: 8.8

debian

больше 8 лет назад

Heap-based buffer overflow in the decode_dds1 function in libavcodec/d ...

GHSA-4hqq-p5x5-j8xc

CVSS3: 8.8

github

больше 3 лет назад

Heap-based buffer overflow in the decode_dds1 function in libavcodec/dfa.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file.

EPSS

Процентиль: 72%

0.00699

Низкий

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-119