Memory Leak Vulnerability in FFmpeg Package - CVE-2016-7555
Summary
ALPINE-CVE-2016-7555: The avi_read_header function in libavformat/avidec.c in FFmpeg before 3.1.4 is vulnerable to memory leak when decoding an AVI file that has a crafted "strh" structure. Affects ffmpeg versions < 3.0.7-r0. Fixed in 3.0.7-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FFmpeg is a widely used open-source software suite for handling multimedia data, including audio and video processing. It provides a rich set of libraries and tools for encoding, decoding, transcoding, muxing, demuxing, streaming, filtering, and playing almost anything that humans and machines have created. The vulnerability in question affects versions of FFmpeg prior to 3.1.4, where the avi_read_header function in libavformat/avidec.c is susceptible to a memory leak when processing specially crafted AVI files.
Vulnerability Detail
The vulnerability arises from the avi_read_header function, which fails to properly manage memory when decoding an AVI file containing a crafted 'strh' structure. This oversight can lead to a memory leak, potentially allowing an attacker to exploit the vulnerability by providing a malicious AVI file. The ramifications include increased memory usage and potential denial of service, as the application may exhaust available memory resources.
How To Fix
Minimum fixed version
3.0.7-r0
This is the first release that contains the fix.
sudo apk add --upgrade ffmpegTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid processing untrusted or unknown AVI files until the package is updated. Implementing strict validation on input files can also help mitigate the risk of exploitation.
Conclusion
In summary, CVE-2016-7555 is a memory leak vulnerability in the FFmpeg package that can be exploited through crafted AVI files. It is crucial to update to the patched version to mitigate risks associated with this vulnerability. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in your software.
See every vulnerability recorded for ffmpeg →
FAQ
CVE-2016-7555 is a vulnerability in FFmpeg that allows for a memory leak when decoding specially crafted AVI files.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The main consequence is a memory leak that can lead to increased memory consumption and potential denial of service.
Yes, the vulnerability is patched in FFmpeg version 3.0.7-r0 and later.
If an immediate update is not possible, avoid processing untrusted AVI files and implement input validation to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for ffmpeg.
