Heap-Based Buffer Overflow in FFmpeg: CVE-2017-9991
Summary
ALPINE-CVE-2017-9991: Heap-based buffer overflow in the xwd_decode_frame function in libavcodec/xwddec.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 allows remote attackers to ca... Affects ffmpeg versions < 3.1.8-r0. Fixed in 3.1.8-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FFmpeg is a widely used open-source multimedia framework that enables users to record, convert, and stream audio and video. It supports a vast array of codecs and formats, making it a critical tool for developers and media professionals. However, certain versions of FFmpeg are vulnerable to a heap-based buffer overflow, which can lead to application crashes and potential exploitation by attackers.
Vulnerability Detail
The vulnerability identified as CVE-2017-9991 is a heap-based buffer overflow found in the xwd_decode_frame function within the libavcodec/xwddec.c file of FFmpeg. This issue affects versions prior to 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1. Attackers can exploit this vulnerability by crafting a malicious file that, when processed by FFmpeg, can cause a denial of service (application crash) or potentially lead to other unspecified impacts.
How To Fix
Minimum fixed version
3.1.8-r0
This is the first release that contains the fix.
sudo apk add --upgrade ffmpegTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid processing untrusted or potentially malicious files with FFmpeg until the software is updated to a secure version. Additionally, implementing strict input validation can help mitigate the risk of exploitation.
Conclusion
CVE-2017-9991 is a significant vulnerability in FFmpeg that can lead to severe consequences if not addressed. Users are strongly encouraged to update to the latest patched versions to ensure their systems remain secure. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for ffmpeg →
FAQ
CVE-2017-9991 is a vulnerability in FFmpeg that allows for a heap-based buffer overflow, potentially leading to application crashes or other impacts.
Versions of FFmpeg prior to 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without any signup.
The CVSS score for CVE-2017-9991 is 7.8, indicating a high severity level.
If an immediate update is not possible, avoid processing untrusted files with FFmpeg and implement input validation to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for ffmpeg.
