CVE-2016-3062

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2016-3062
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-3062.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2016-3062
Downstream
Related
Published
2016-06-16T18:59:08Z
Modified
2025-10-21T03:40:25.850493Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

The movreaddref function in libavformat/mov.c in Libav before 11.7 and FFmpeg before 0.11 allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via the entries value in a dref box in an MP4 file.

References

Affected packages

Git / git.ffmpeg.org/ffmpeg.git

Affected ranges

Type
GIT
Repo
https://git.ffmpeg.org/ffmpeg.git
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Type
GIT
Repo
https://github.com/ffmpeg/ffmpeg
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
689e59b7ffed34eba6159dcc78e87133862e3746
Type
GIT
Repo
https://github.com/libav/libav
Events
Introduced
0 Unknown introduced commit / All previous commits are affected

Affected versions

Other

N

n0.*

n0.11-dev
n0.8

Database specific

vanir_signatures

[
    {
        "source": "https://github.com/ffmpeg/ffmpeg/commit/689e59b7ffed34eba6159dcc78e87133862e3746",
        "signature_version": "v1",
        "target": {
            "file": "libavformat/mov.c",
            "function": "mov_read_dref"
        },
        "digest": {
            "length": 2968.0,
            "function_hash": "200661769134576889566610710176461660895"
        },
        "deprecated": false,
        "signature_type": "Function",
        "id": "CVE-2016-3062-0e5bcfb1"
    },
    {
        "source": "https://github.com/ffmpeg/ffmpeg/commit/689e59b7ffed34eba6159dcc78e87133862e3746",
        "signature_version": "v1",
        "target": {
            "file": "libavformat/mov.c"
        },
        "digest": {
            "line_hashes": [
                "317154361394325592763235173574819288465",
                "81931024720670069676695763964305328371",
                "99180079691106904150277618992627971739",
                "154943404290230601118350232460207894058"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "signature_type": "Line",
        "id": "CVE-2016-3062-f28fc5ab"
    }
]