Infinite Loop Vulnerability in FFmpeg
Summary
CVE-2016-7122: The avi_read_nikon function in libavformat/avidec.c in FFmpeg before 3.1.4 is vulnerable to infinite loop when it decodes an AVI file that has a crafted 'nctg' structure. Affects ffmpeg across 2 version ranges.
< 2.8.11-r0
< c46d22a4a58467bdc7885685b06a2114dd181c43
Fixed in 2.8.11-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FFmpeg is a popular open-source multimedia framework used for decoding, encoding, transcoding, and streaming audio and video files. It is widely utilized in various applications and platforms. However, a vulnerability has been discovered in FFmpeg versions before 3.1.4 that can lead to an infinite loop when decoding AVI files with a crafted 'nctg' structure.
Vulnerability Detail
The vulnerability (CVE-2016-7122) originates from the avi_read_nikon function in the avidec.c file of FFmpeg. When processing an AVI file containing a malicious 'nctg' structure, the function enters an infinite loop. This can result in resource exhaustion, leading to denial of service (DoS) conditions. An attacker could exploit this vulnerability by tricking a user into opening a specially crafted AVI file, causing the application to hang or crash.
How To Fix
Minimum fixed version
2.8.11-r0
This is the first release that contains the fix.
sudo apk add --upgrade ffmpegTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can avoid opening AVI files from untrusted or unknown sources. Additionally, implementing proper input validation and error handling in applications that utilize FFmpeg can help mitigate the risk of exploitation.
Conclusion
The infinite loop vulnerability in FFmpeg can be mitigated by updating to the recommended versions or by following the provided workarounds. It is crucial to keep software up to date and exercise caution when handling files from untrusted sources. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ffmpeg →
FAQ
FFmpeg is an open-source multimedia framework used for audio and video processing, encoding, decoding, and streaming.
The vulnerability can lead to denial of service (DoS) conditions, causing the application to hang or crash.
To fix the vulnerability in Alpine v3.3, update FFmpeg to version 2.8.11-r0 or later.
To fix the vulnerability in Alpine v3.4, update FFmpeg to version 3.0.7-r0 or later.
As a workaround, avoid opening AVI files from untrusted or unknown sources and ensure proper input validation in applications.
Related vulnerabilities
Recent vulnerabilities recorded for ffmpeg.
