PT-2017-19067

CVE-2017-9608

Published

2017-08-01

Updated

2018-01-17

Description by

CVSS 3.1

6.5

Medium

MetricsAV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 3.2.6 FFmpeg version 3.3.x prior to 3.3.3

Description The issue allows remote attackers to cause a denial of service, specifically a NULL pointer dereference, by using a crafted mov file. This is related to the dnxhd decoder in FFmpeg.

Recommendations For FFmpeg versions prior to 3.2.6, update to version 3.2.6 or later. For FFmpeg version 3.3.x prior to 3.3.3, update to version 3.3.3 or later.

Exploitability

Fix

Impacts

Researchers

Yihan Lian

Vendors

Affected products

Weakness enumeration

CWE-476: NULL Pointer Dereference

Related identifiers

CVE-2017-9608

ALT-PU-2017-1960