Heap-Based Buffer Overflow in FFmpeg: CVE-2017-9992
Summary
ALPINE-CVE-2017-9992: Heap-based buffer overflow in the decode_dds1 function in libavcodec/dfa.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 allows remote attackers to cause a de... Affects ffmpeg versions < 3.1.8-r0. Fixed in 3.1.8-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FFmpeg is a widely-used open-source software suite for handling multimedia data, including audio and video processing. It provides functionalities for encoding, decoding, transcoding, muxing, demuxing, streaming, filtering, and playing various multimedia formats. The package is known for its versatility and performance but has been identified to have vulnerabilities that can be exploited if not properly managed.
Vulnerability Detail
The vulnerability identified as CVE-2017-9992 is a heap-based buffer overflow in the decode_dds1 function located in libavcodec/dfa.c of FFmpeg. This issue affects versions prior to 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1. Attackers can exploit this vulnerability by crafting a malicious file that, when processed by FFmpeg, can lead to a denial of service (application crash) or potentially other unspecified impacts. The CVSS score for this vulnerability is 8.8, indicating a high severity level.
How To Fix
Minimum fixed version
3.1.8-r0
This is the first release that contains the fix.
sudo apk add --upgrade ffmpegTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not possible, consider restricting access to the FFmpeg application or disabling the processing of untrusted files until the update can be applied.
Conclusion
CVE-2017-9992 represents a significant vulnerability in FFmpeg that can lead to severe consequences if exploited. It is crucial to update to the patched versions to mitigate risks associated with this vulnerability. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain the security of your applications.
See every vulnerability recorded for ffmpeg →
FAQ
CVE-2017-9992 is a vulnerability in FFmpeg that allows remote attackers to exploit a heap-based buffer overflow, potentially causing application crashes or other impacts.
The affected versions include FFmpeg versions before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without any signup.
The CVSS score for this vulnerability is 8.8, indicating a high severity level that requires immediate attention.
If you cannot update immediately, consider restricting access to the application or disabling the processing of untrusted files until the patch can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for ffmpeg.
