Vulnerability CVE-2017-15186: Information

Description

Double free vulnerability in FFmpeg 3.3.4 and earlier allows remote attackers to cause a denial of service via a crafted AVI file.

Severity: MEDIUM (6.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

URL: https://nvd.nist.gov/vuln/detail/CVE-2017-15186
Published: Oct. 24, 2017
Modified: Nov. 29, 2017
Error type identifier: CWE-415

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
ffmpegsisyphus3.3.5-alt16.1.1-alt3ALT-PU-2017-2526-1192418Fixed
ffmpegp103.3.5-alt14.4.4-alt1ALT-PU-2017-2526-1192418Fixed
ffmpegp93.3.5-alt14.3.6-alt1ALT-PU-2017-2526-1192418Fixed
ffmpegc10f13.3.5-alt14.4.4-alt1ALT-PU-2017-2526-1192418Fixed
ffmpegc9f23.3.5-alt14.3.6-alt1ALT-PU-2017-2526-1192418Fixed
ffmpegp113.3.5-alt16.1.1-alt3ALT-PU-2017-2526-1192418Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
101518
  • Third Party Advisory
  • VDB Entry
[oss-security] 20171020 [CVE-2017-15186]: ffmpeg: Double free when ffmpeg parsing an craft AVI file to MKV file using ffvhuff decoder
  • Mailing List
  • Patch
  • Third Party Advisory
DSA-4049

      1. Configuration 1

        cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*
        End including
        3.3.4
    VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
    Version: v24.5.3
    Back to top