Heap-Based Buffer Overflow Vulnerability in FFmpeg - CVE-2017-9996
Summary
ALPINE-CVE-2017-9996: The cdxl_decode_frame function in libavcodec/cdxl.c in FFmpeg 2.8.x before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 does not exclude the CHUNKY format, which allows remot... Affects ffmpeg versions < 3.1.8-r0. Fixed in 3.1.8-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FFmpeg is a widely used open-source multimedia framework that enables users to record, convert, and stream audio and video. It supports various formats and codecs, making it a powerful tool for media processing. However, certain versions of FFmpeg contain a vulnerability that can lead to severe security issues, particularly in the handling of specific file formats.
Vulnerability Detail
The vulnerability identified as CVE-2017-9996 resides in the cdxl_decode_frame function within the libavcodec/cdxl.c file of FFmpeg. This issue affects versions 2.8.x before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1. The flaw arises from the failure to exclude the CHUNKY format, which allows remote attackers to exploit this weakness, potentially resulting in a denial of service through heap-based buffer overflow and application crashes. The CVSS score for this vulnerability is 7.8, indicating a high severity level.
How To Fix
Minimum fixed version
3.1.8-r0
This is the first release that contains the fix.
sudo apk add --upgrade ffmpegTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid processing files that may contain the CHUNKY format until the package is updated. This can help mitigate the risk of exploitation until a proper fix is applied.
Conclusion
CVE-2017-9996 is a significant vulnerability in FFmpeg that can lead to severe consequences if not addressed. Users are strongly advised to update their FFmpeg installations to the latest patched versions to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for ffmpeg →
FAQ
CVE-2017-9996 is a vulnerability in FFmpeg that can lead to a heap-based buffer overflow, allowing attackers to crash the application or potentially exploit it further.
Affected versions include FFmpeg 2.8.x before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
If you cannot update FFmpeg right away, avoid processing files that may contain the CHUNKY format to reduce the risk of exploitation.
The CVSS score for CVE-2017-9996 is 7.8, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for ffmpeg.
