NULL Pointer Dereference in dnxhd Decoder in FFmpeg
Summary
CVE-2017-9608: The dnxhd decoder in FFmpeg before 3.2.6, and 3.3.x before 3.3.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted mov file. Affects ffmpeg across 5 version ranges.
< 0a709e2a10b8288a0cc383547924ecfe285cef89
< 3.2.6-r0
< 31c1c0b46a7021802c3d1d18039fca30dba5a14e
< 431ccd3f55eae8732fe901622660c52fc712cc25
< 611b35627488a8d0763e75c25ee0875c5b7987dd
Fixed in 3.2.6-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
FFmpeg is a popular open-source multimedia framework that is widely used for handling audio and video processing. It provides a set of libraries and tools for encoding, decoding, and streaming various media formats. The dnxhd decoder is a component of FFmpeg that is responsible for decoding video files in the DNxHD format. This vulnerability (CVE-2017-9608) affects FFmpeg versions before 3.2.6 and 3.3.x before 3.3.3.
Vulnerability Detail
The vulnerability allows remote attackers to cause a denial of service (NULL pointer dereference) by exploiting a flaw in the dnxhd decoder when processing a crafted MOV file. A NULL pointer dereference occurs when a program attempts to access or manipulate memory using a null pointer, leading to a crash or unexpected behavior. In this case, an attacker can create a specially crafted MOV file that triggers the NULL pointer dereference in the dnxhd decoder, causing the FFmpeg application to crash.
How To Fix
Minimum fixed version
3.2.6-r0
This is the first release that contains the fix.
sudo apk add --upgrade ffmpegTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by updating FFmpeg to a patched version.
Conclusion
The NULL pointer dereference vulnerability in the dnxhd decoder of FFmpeg can be exploited by remote attackers to cause a denial of service. It is crucial to update FFmpeg to version 3.2.6 or later to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ffmpeg →
FAQ
FFmpeg is an open-source multimedia framework used for handling audio and video processing. It provides a set of libraries and tools for encoding, decoding, and streaming various media formats.
The dnxhd decoder is a component of FFmpeg responsible for decoding video files in the DNxHD format. It allows FFmpeg to process and play DNxHD-encoded videos.
A NULL pointer dereference occurs when a program attempts to access or manipulate memory using a null pointer. This can lead to a crash or unexpected behavior.
An attacker can exploit this vulnerability by creating a specially crafted MOV file that triggers the NULL pointer dereference in the dnxhd decoder. When the vulnerable FFmpeg application processes this file, it crashes.
To fix this vulnerability, update FFmpeg to version 3.2.6 or later. This update includes a patch for the dnxhd decoder to handle the crafted MOV file correctly and prevent the NULL pointer dereference.
Related vulnerabilities
Recent vulnerabilities recorded for ffmpeg.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
