CVE-2016-7905: Denial of Service in FFmpeg
Summary
CVE-2016-7905: The read_gab2_sub function in libavformat/avidec.c in FFmpeg before 3.1.4 allows remote attackers to cause a denial of service (NULL pointer used) via a crafted AVI file. Affects ffmpeg across 2 version ranges.
< 2.8.11-r0
< c46d22a4a58467bdc7885685b06a2114dd181c43
Fixed in 2.8.11-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FFmpeg is a popular open-source multimedia framework that allows users to decode, encode, transcode, and stream audio and video files. It is widely used in various applications and platforms. However, a vulnerability has been discovered in FFmpeg versions prior to 3.1.4 that can lead to a denial of service (DoS) attack. This vulnerability exists in the read_gab2_sub function in the avidec.c file, which is responsible for processing AVI files. By exploiting this vulnerability, remote attackers can cause a NULL pointer dereference, resulting in a crash or hang of the application.
Vulnerability Detail
The vulnerability (CVE-2016-7905) in FFmpeg arises due to improper handling of AVI files. When a specially crafted AVI file is processed by the read_gab2_sub function, a NULL pointer is used, leading to a DoS condition. This vulnerability can be exploited by remote attackers to disrupt the normal functioning of applications that utilize FFmpeg for AVI file processing. The impact of this vulnerability can range from a temporary application crash to a complete system freeze, depending on the severity of the attack.
How To Fix
Minimum fixed version
2.8.11-r0
This is the first release that contains the fix.
sudo apk add --upgrade ffmpegTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid processing untrusted AVI files using FFmpeg. By refraining from opening AVI files from unknown or untrusted sources, the risk of exploitation can be minimized. Additionally, implementing proper input validation and sanitization in applications that utilize FFmpeg can help mitigate the impact of this vulnerability.
Conclusion
The vulnerability (CVE-2016-7905) in FFmpeg versions prior to 3.1.4 can lead to a denial of service (DoS) attack by exploiting improper handling of AVI files. To mitigate this vulnerability, it is crucial to update FFmpeg to the latest version and refrain from processing untrusted AVI files. Regularly updating FFmpeg and implementing proper input validation can help ensure the security and stability of applications that rely on FFmpeg. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ffmpeg →
FAQ
FFmpeg is an open-source multimedia framework that allows users to decode, encode, transcode, and stream audio and video files. It is widely used in various applications and platforms.
CVE-2016-7905 is a vulnerability in FFmpeg versions prior to 3.1.4 that can lead to a denial of service (DoS) attack. It arises due to improper handling of AVI files and can be exploited by remote attackers to crash or hang applications that utilize FFmpeg for AVI file processing.
A NULL pointer dereference occurs when a program attempts to access or manipulate memory using a NULL pointer, which points to no valid memory location. In the case of CVE-2016-7905, the read_gab2_sub function in FFmpeg's avidec.c file uses a NULL pointer, leading to a crash or hang of the application.
The impact of CVE-2016-7905 can range from a temporary application crash to a complete system freeze, depending on the severity of the attack. Exploiting this vulnerability can disrupt the normal functioning of applications that utilize FFmpeg for AVI file processing.
To mitigate the risk of CVE-2016-7905, it is recommended to update FFmpeg to version 3.1.4 or later. Additionally, users should avoid processing untrusted AVI files using FFmpeg and implement proper input validation and sanitization in applications that utilize FFmpeg.
References
Related vulnerabilities
Recent vulnerabilities recorded for ffmpeg.
