Heap Corruption Vulnerability in FFmpeg - CVE-2016-5199
Summary
ALPINE-CVE-2016-5199: An off by one error resulting in an allocation of zero size in FFmpeg in Google Chrome prior to 54.0.2840.98 for Mac, and 54.0.2840.99 for Windows, and 54.0.2840.100 for Linux, and 55.0.2883.84 for Android allowed a remo... Affects ffmpeg versions < 3.0.7-r0. Fixed in 3.0.7-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FFmpeg is a widely used open-source multimedia framework that enables users to record, convert, and stream audio and video. It supports a vast array of codecs and formats, making it a crucial tool for developers and media professionals. However, FFmpeg has been found to have a vulnerability that could lead to serious security issues, particularly in versions prior to 3.0.7-r0.
Vulnerability Detail
CVE-2016-5199 is an off-by-one error in FFmpeg that results in the allocation of zero size memory. This vulnerability affects Google Chrome versions prior to 54.0.2840.98 for Mac, 54.0.2840.99 for Windows, 54.0.2840.100 for Linux, and 55.0.2883.84 for Android. A remote attacker could exploit this vulnerability by crafting a malicious video file, potentially leading to heap corruption, which could allow for arbitrary code execution or crashes.
How To Fix
Minimum fixed version
3.0.7-r0
This is the first release that contains the fix.
sudo apk add --upgrade ffmpegTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate update is not possible, consider restricting access to the application or disabling the ability to process untrusted video files until the patch can be applied.
Conclusion
CVE-2016-5199 is a significant vulnerability in FFmpeg that could lead to severe security risks if not addressed. Users are strongly advised to update to the patched version to mitigate potential threats.
See every vulnerability recorded for ffmpeg →
FAQ
CVE-2016-5199 is a vulnerability in FFmpeg that can lead to heap corruption due to an off-by-one error.
An attacker can exploit this vulnerability by sending a specially crafted video file to the application, potentially leading to arbitrary code execution.
FFmpeg versions prior to 3.0.7-r0 are affected by this vulnerability.
The CVSS score for CVE-2016-5199 is 8.8, indicating a high severity level.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for ffmpeg.
