CVE-2017-9992

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 2.8.12 FFmpeg versions 3.0.x prior to 3.0.8 FFmpeg versions 3.1.x prior to 3.1.8 FFmpeg versions 3.2.x prior to 3.2.5 FFmpeg versions 3.3.x prior to 3.3.1

Description A heap-based buffer overflow issue exists in the decode dds1 function, located in libavcodec/dfa.c, which can be triggered by remote attackers using a crafted file. This issue may cause a denial of service, resulting in an application crash, or potentially have other unspecified impacts.

Recommendations For FFmpeg versions prior to 2.8.12, update to version 2.8.12 or later. For FFmpeg versions 3.0.x prior to 3.0.8, update to version 3.0.8 or later. For FFmpeg versions 3.1.x prior to 3.1.8, update to version 3.1.8 or later. For FFmpeg versions 3.2.x prior to 3.2.5, update to version 3.2.5 or later. For FFmpeg versions 3.3.x prior to 3.3.1, update to version 3.3.1 or later.