CVE-2017-9991

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2017-9991
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-9991.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2017-9991
Related
Published
2017-06-28T06:29:00Z
Modified
2024-10-29T00:04:50.886418Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Heap-based buffer overflow in the xwddecodeframe function in libavcodec/xwddec.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file.

References

Affected packages

Alpine:v3.4 / ffmpeg

Package

Name
ffmpeg
Purl
pkg:apk/alpine/ffmpeg?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.1.8-r0

Affected versions

0.*

0.5-r0
0.6-r0
0.6-r1
0.6-r2
0.6.1-r0
0.6.1-r1
0.6.2-r0
0.6.2-r1
0.6.2-r2
0.6.3-r0
0.6.3-r1
0.6.3-r2
0.8-r0
0.8.1-r0
0.8.2-r0
0.8.3-r0
0.8.4-r0
0.8.5-r0
0.8.5-r1
0.8.6-r0
0.8.7-r0
0.9-r0
0.9.1-r0
0.10-r0
0.10-r1
0.10-r2
0.10.2-r0
0.11-r0
0.11.1-r0
0.11.1-r1
0.11.2-r1

1.*

1.0-r0
1.0-r1
1.0-r2
1.0.1-r0
1.0.1-r1
1.1-r1
1.1.2-r1
1.1.2-r2
1.1.2-r3
1.1.3-r0
1.1.4-r0
1.2-r0
1.2-r1
1.2.1-r0
1.2.2-r0
1.2.4-r0

2.*

2.0.2-r0
2.1-r0
2.1.1-r0
2.1.3-r0
2.1.4-r0
2.2-r0
2.2.2-r0
2.2.3-r0
2.2.4-r0
2.2.4-r1
2.2.4-r2
2.2.4-r3
2.3-r0
2.3.1-r0
2.3.2-r0
2.3.3-r0
2.3.4-r0
2.3.4-r1
2.3.4-r2
2.3.5-r0
2.5.1-r0
2.5.2-r0
2.5.2-r1
2.5.3-r0
2.5.4-r0
2.6.1-r0
2.6.2-r0
2.6.2-r1
2.6.2-r2
2.6.3-r0
2.7-r0
2.7.1-r0
2.7.1-r1
2.7.2-r0
2.8-r0
2.8-r1
2.8-r2
2.8.1-r0
2.8.2-r0
2.8.2-r1
2.8.3-r0
2.8.5-r0

3.*

3.0.1-r0
3.0.2-r0
3.0.2-r1
3.0.7-r0

Alpine:v3.5 / ffmpeg

Package

Name
ffmpeg
Purl
pkg:apk/alpine/ffmpeg?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.1.8-r0

Affected versions

0.*

0.5-r0
0.6-r0
0.6-r1
0.6-r2
0.6.1-r0
0.6.1-r1
0.6.2-r0
0.6.2-r1
0.6.2-r2
0.6.3-r0
0.6.3-r1
0.6.3-r2
0.8-r0
0.8.1-r0
0.8.2-r0
0.8.3-r0
0.8.4-r0
0.8.5-r0
0.8.5-r1
0.8.6-r0
0.8.7-r0
0.9-r0
0.9.1-r0
0.10-r0
0.10-r1
0.10-r2
0.10.2-r0
0.11-r0
0.11.1-r0
0.11.1-r1
0.11.2-r1

1.*

1.0-r0
1.0-r1
1.0-r2
1.0.1-r0
1.0.1-r1
1.1-r1
1.1.2-r1
1.1.2-r2
1.1.2-r3
1.1.3-r0
1.1.4-r0
1.2-r0
1.2-r1
1.2.1-r0
1.2.2-r0
1.2.4-r0

2.*

2.0.2-r0
2.1-r0
2.1.1-r0
2.1.3-r0
2.1.4-r0
2.2-r0
2.2.2-r0
2.2.3-r0
2.2.4-r0
2.2.4-r1
2.2.4-r2
2.2.4-r3
2.3-r0
2.3.1-r0
2.3.2-r0
2.3.3-r0
2.3.4-r0
2.3.4-r1
2.3.4-r2
2.3.5-r0
2.5.1-r0
2.5.2-r0
2.5.2-r1
2.5.3-r0
2.5.4-r0
2.6.1-r0
2.6.2-r0
2.6.2-r1
2.6.2-r2
2.6.3-r0
2.7-r0
2.7.1-r0
2.7.1-r1
2.7.2-r0
2.8-r0
2.8-r1
2.8-r2
2.8.1-r0
2.8.2-r0
2.8.2-r1
2.8.3-r0
2.8.5-r0

3.*

3.0.1-r0
3.0.2-r0
3.0.2-r1
3.1-r0
3.1.1-r0
3.1.2-r0
3.1.3-r0
3.1.4-r0
3.1.6-r0
3.1.7-r0

Alpine:v3.6 / ffmpeg

Package

Name
ffmpeg
Purl
pkg:apk/alpine/ffmpeg?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.2.5-r0

Affected versions

0.*

0.5-r0
0.6-r0
0.6-r1
0.6-r2
0.6.1-r0
0.6.1-r1
0.6.2-r0
0.6.2-r1
0.6.2-r2
0.6.3-r0
0.6.3-r1
0.6.3-r2
0.8-r0
0.8.1-r0
0.8.2-r0
0.8.3-r0
0.8.4-r0
0.8.5-r0
0.8.5-r1
0.8.6-r0
0.8.7-r0
0.9-r0
0.9.1-r0
0.10-r0
0.10-r1
0.10-r2
0.10.2-r0
0.11-r0
0.11.1-r0
0.11.1-r1
0.11.2-r1

1.*

1.0-r0
1.0-r1
1.0-r2
1.0.1-r0
1.0.1-r1
1.1-r1
1.1.2-r1
1.1.2-r2
1.1.2-r3
1.1.3-r0
1.1.4-r0
1.2-r0
1.2-r1
1.2.1-r0
1.2.2-r0
1.2.4-r0

2.*

2.0.2-r0
2.1-r0
2.1.1-r0
2.1.3-r0
2.1.4-r0
2.2-r0
2.2.2-r0
2.2.3-r0
2.2.4-r0
2.2.4-r1
2.2.4-r2
2.2.4-r3
2.3-r0
2.3.1-r0
2.3.2-r0
2.3.3-r0
2.3.4-r0
2.3.4-r1
2.3.4-r2
2.3.5-r0
2.5.1-r0
2.5.2-r0
2.5.2-r1
2.5.3-r0
2.5.4-r0
2.6.1-r0
2.6.2-r0
2.6.2-r1
2.6.2-r2
2.6.3-r0
2.7-r0
2.7.1-r0
2.7.1-r1
2.7.2-r0
2.8-r0
2.8-r1
2.8-r2
2.8.1-r0
2.8.2-r0
2.8.2-r1
2.8.3-r0
2.8.5-r0

3.*

3.0.1-r0
3.0.2-r0
3.0.2-r1
3.1-r0
3.1.1-r0
3.1.2-r0
3.1.3-r0
3.1.4-r0
3.1.6-r0
3.2.2-r0
3.2.2-r1
3.2.4-r0
3.2.4-r1

Debian:11 / ffmpeg

Package

Name
ffmpeg
Purl
pkg:deb/debian/ffmpeg?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
7:3.2.5-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / ffmpeg

Package

Name
ffmpeg
Purl
pkg:deb/debian/ffmpeg?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
7:3.2.5-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / ffmpeg

Package

Name
ffmpeg
Purl
pkg:deb/debian/ffmpeg?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
7:3.2.5-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Git / git.ffmpeg.org/ffmpeg.git

Affected ranges

Type
GIT
Repo
https://git.ffmpeg.org/ffmpeg.git
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
148c4fb8d203fdef8589ccef56a995724938918b
Last affected
2a5c41e3e4a7e763503af59de903d5649dcc071a
Last affected
340cea9f22c162e10d120835661e132721b7454b
Last affected
3512ed3622e1200f03e0d508b5c1bcbf9f5d2c88
Last affected
384d90f26800521440a1d64d7c6967e9b552a690
Last affected
4275b27a230008c41c63397871f173952723e2b2
Last affected
5771a0c8237d6fb0fb65877126ec0f7842fd2a1e
Last affected
68ed682710f1cb1f4fdd1fd0447f402d6feabd01
Last affected
b408dba231091cd7f465ddf8bd8babf5b7efe63a
Last affected
c269c43a83166003ab6649263bc60634a6b7866f
Last affected
c2ea70628215ccede53240843b4514a6c339ab27
Last affected
c40983a6f631d22fede713d535bb9c31d5c9740c
Last affected
c46d22a4a58467bdc7885685b06a2114dd181c43
Last affected
c63e58756699d07b5bc69799db388600d3e634bf
Last affected
c66f4d1ae64dffaf456d05cbdade02054446f499
Last affected
ce36e74e75751c721185fbebaa4ee8714b44c5a5
Last affected
d4b731e271ba944ade8f6a128271479529507de9
Last affected
e08b1cf2df8cfdb3394aa5ab0320739f8b5a1c4f
Last affected
e8b94e5ce48f0dd68287e8b1c2ef4125fabff1d7
Last affected
efa89a841941bf61d1a3eb5c2900f98e3e7db85b
Last affected
fbc96c50d72f55131e43939e38c1e5af4315a755
Last affected
fda00aa7749326f02a6ca0a7d9bd9bcda1054071
Type
GIT
Repo
https://github.com/ffmpeg/ffmpeg
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
441026fcb13ac23aa10edc312bdacb6445a0ad06

Affected versions

Other

N

n0.*

n0.11-dev
n0.12-dev
n0.8

n1.*

n1.1-dev
n1.2-dev
n1.3-dev

n2.*

n2.0
n2.1-dev
n2.2-dev
n2.3-dev
n2.4-dev
n2.5-dev
n2.6-dev
n2.7-dev
n2.8-dev
n2.9-dev

n3.*

n3.0
n3.0.1
n3.0.2
n3.0.3
n3.1
n3.1-dev
n3.1.1
n3.1.2
n3.1.3
n3.1.4
n3.1.5
n3.2
n3.2-dev
n3.2.1
n3.2.2
n3.3-dev
n3.4-dev