Critical Double Free Vulnerability in FFmpeg Package
Summary
ALPINE-CVE-2017-15186: Double free vulnerability in FFmpeg 3.3.4 and earlier allows remote attackers to cause a denial of service via a crafted AVI file. Affects ffmpeg versions < 3.1.11-r1. Fixed in 3.1.11-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FFmpeg is a widely used open-source multimedia framework that enables users to record, convert, and stream audio and video. It supports various formats and codecs, making it a vital tool for developers and content creators. However, certain versions of FFmpeg are susceptible to a double free vulnerability, which can lead to severe security issues.
Vulnerability Detail
The vulnerability, identified as CVE-2017-15186, is a double free issue present in FFmpeg versions 3.3.4 and earlier. This flaw allows remote attackers to exploit crafted AVI files, potentially leading to a denial of service. The vulnerability arises from improper memory management, where memory is freed more than once, causing instability and crashes in applications that utilize the affected FFmpeg versions.
How To Fix
Minimum fixed version
3.1.11-r1
This is the first release that contains the fix.
sudo apk add --upgrade ffmpegTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid processing untrusted AVI files until the package is updated. This can help mitigate the risk of exploitation while waiting for a proper fix.
Conclusion
The double free vulnerability in FFmpeg poses significant risks to applications that rely on this multimedia framework. Users are strongly encouraged to update to the latest patched versions to ensure their systems remain secure. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for ffmpeg →
FAQ
CVE-2017-15186 is a double free vulnerability in FFmpeg that allows remote attackers to cause a denial of service through crafted AVI files.
FFmpeg versions 3.3.4 and earlier are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without signup.
The CVSS score for this vulnerability is 6.5, indicating a medium severity level.
If immediate updates are not possible, avoid processing untrusted AVI files to minimize the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for ffmpeg.
