CVE-2017-9996
- Source
- https://cve.org/CVERecord?id=CVE-2017-9996
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-9996.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2017-9996
- Downstream
- Published
- 2017-06-28T06:29:00.613Z
- Modified
- 2026-08-17T05:26:01.235546Z
- Severity
-
- 7.8 (High) CVSS_V3 - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
The cdxldecodeframe function in libavcodec/cdxl.c in FFmpeg 2.8.x before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 does not exclude the CHUNKY format, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.
- References
-
- http://www.securityfocus.com/bid/99323
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1378
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1427
- https://github.com/FFmpeg/FFmpeg/commit/1e42736b95065c69a7481d0cf55247024f54b660
- https://github.com/FFmpeg/FFmpeg/commit/e1b60aad77c27ed5d4dfc11e5e6a05a38c70489d
Affected packages
Git / git.ffmpeg.org/ffmpeg.git
Affected ranges
- Type
- GIT
- Repo
- https://git.ffmpeg.org/ffmpeg.git
- Events
-
IntroducedLast affected
- Database specific
-
Show details
{ "cpe": [ "cpe:2.3:a:ffmpeg:ffmpeg:2.8:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:2.8.1:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:2.8.2:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:2.8.3:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:2.8.4:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:2.8.5:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:2.8.6:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:2.8.7:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:2.8.8:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:2.8.9:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:2.8.10:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:2.8.11:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:3.0:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:3.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:3.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:3.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:3.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:3.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:3.0.6:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:3.0.7:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:3.1:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:3.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:3.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:3.1.3:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:3.1.4:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:3.1.5:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:3.1.6:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:3.1.7:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:3.2:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:3.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:3.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:3.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:3.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:3.3:*:*:*:*:*:*:*" ], "source": "CPE_STRING", "extracted_events": [ { "introduced": "2.8" }, { "last_affected": "2.8" }, { "introduced": "2.8.1" }, { "last_affected": "2.8.1" }, { "introduced": "2.8.2" }, { "last_affected": "2.8.2" }, { "introduced": "2.8.3" }, { "last_affected": "2.8.3" }, { "introduced": "2.8.4" }, { "last_affected": "2.8.4" }, { "introduced": "2.8.5" }, { "last_affected": "2.8.5" }, { "introduced": "2.8.6" }, { "last_affected": "2.8.6" }, { "introduced": "2.8.7" }, { "last_affected": "2.8.7" }, { "introduced": "2.8.8" }, { "last_affected": "2.8.8" }, { "introduced": "2.8.9" }, { "last_affected": "2.8.9" }, { "introduced": "2.8.10" }, { "last_affected": "2.8.10" }, { "introduced": "2.8.11" }, { "last_affected": "2.8.11" }, { "introduced": "3.0" }, { "last_affected": "3.0" }, { "introduced": "3.0.1" }, { "last_affected": "3.0.1" }, { "introduced": "3.0.2" }, { "last_affected": "3.0.2" }, { "introduced": "3.0.3" }, { "last_affected": "3.0.3" }, { "introduced": "3.0.4" }, { "last_affected": "3.0.4" }, { "introduced": "3.0.5" }, { "last_affected": "3.0.5" }, { "introduced": "3.0.6" }, { "last_affected": "3.0.6" }, { "introduced": "3.0.7" }, { "last_affected": "3.0.7" }, { "introduced": "3.1" }, { "last_affected": "3.1" }, { "introduced": "3.1.1" }, { "last_affected": "3.1.1" }, { "introduced": "3.1.2" }, { "last_affected": "3.1.2" }, { "introduced": "3.1.3" }, { "last_affected": "3.1.3" }, { "introduced": "3.1.4" }, { "last_affected": "3.1.4" }, { "introduced": "3.1.5" }, { "last_affected": "3.1.5" }, { "introduced": "3.1.6" }, { "last_affected": "3.1.6" }, { "introduced": "3.1.7" }, { "last_affected": "3.1.7" }, { "introduced": "3.2" }, { "last_affected": "3.2" }, { "introduced": "3.2.1" }, { "last_affected": "3.2.1" }, { "introduced": "3.2.2" }, { "last_affected": "3.2.2" }, { "introduced": "3.2.3" }, { "last_affected": "3.2.3" }, { "introduced": "3.2.4" }, { "last_affected": "3.2.4" }, { "introduced": "3.3" }, { "last_affected": "3.3" } ] }
Git / github.com/ffmpeg/ffmpeg
Affected ranges
- Type
- GIT
- Repo
- https://github.com/ffmpeg/ffmpeg
- Events
-
IntroducedLast affectedFixedFixed
- Database specific
-
Show details
{ "cpe": [ "cpe:2.3:a:ffmpeg:ffmpeg:2.8:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:2.8.1:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:2.8.2:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:2.8.3:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:2.8.4:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:2.8.5:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:2.8.6:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:2.8.7:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:2.8.8:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:2.8.9:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:2.8.10:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:2.8.11:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:3.0:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:3.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:3.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:3.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:3.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:3.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:3.0.6:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:3.0.7:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:3.1:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:3.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:3.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:3.1.3:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:3.1.4:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:3.1.5:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:3.1.6:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:3.1.7:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:3.2:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:3.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:3.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:3.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:3.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:ffmpeg:ffmpeg:3.3:*:*:*:*:*:*:*" ], "source": [ "CPE_STRING", "REFERENCES" ], "extracted_events": [ { "introduced": "2.8" }, { "last_affected": "2.8" }, { "introduced": "2.8.1" }, { "last_affected": "2.8.1" }, { "introduced": "2.8.2" }, { "last_affected": "2.8.2" }, { "introduced": "2.8.3" }, { "last_affected": "2.8.3" }, { "introduced": "2.8.4" }, { "last_affected": "2.8.4" }, { "introduced": "2.8.5" }, { "last_affected": "2.8.5" }, { "introduced": "2.8.6" }, { "last_affected": "2.8.6" }, { "introduced": "2.8.7" }, { "last_affected": "2.8.7" }, { "introduced": "2.8.8" }, { "last_affected": "2.8.8" }, { "introduced": "2.8.9" }, { "last_affected": "2.8.9" }, { "introduced": "2.8.10" }, { "last_affected": "2.8.10" }, { "introduced": "2.8.11" }, { "last_affected": "2.8.11" }, { "introduced": "3.0" }, { "last_affected": "3.0" }, { "introduced": "3.0.1" }, { "last_affected": "3.0.1" }, { "introduced": "3.0.2" }, { "last_affected": "3.0.2" }, { "introduced": "3.0.3" }, { "last_affected": "3.0.3" }, { "introduced": "3.0.4" }, { "last_affected": "3.0.4" }, { "introduced": "3.0.5" }, { "last_affected": "3.0.5" }, { "introduced": "3.0.6" }, { "last_affected": "3.0.6" }, { "introduced": "3.0.7" }, { "last_affected": "3.0.7" }, { "introduced": "3.1" }, { "last_affected": "3.1" }, { "introduced": "3.1.1" }, { "last_affected": "3.1.1" }, { "introduced": "3.1.2" }, { "last_affected": "3.1.2" }, { "introduced": "3.1.3" }, { "last_affected": "3.1.3" }, { "introduced": "3.1.4" }, { "last_affected": "3.1.4" }, { "introduced": "3.1.5" }, { "last_affected": "3.1.5" }, { "introduced": "3.1.6" }, { "last_affected": "3.1.6" }, { "introduced": "3.1.7" }, { "last_affected": "3.1.7" }, { "introduced": "3.2" }, { "last_affected": "3.2" }, { "introduced": "3.2.1" }, { "last_affected": "3.2.1" }, { "introduced": "3.2.2" }, { "last_affected": "3.2.2" }, { "introduced": "3.2.3" }, { "last_affected": "3.2.3" }, { "introduced": "3.2.4" }, { "last_affected": "3.2.4" }, { "introduced": "3.3" }, { "last_affected": "3.3" } ] }
Affected versions
2.*
2.8
2.8.1
2.8.10
2.8.11
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.8.8
2.8.9
3.*
3.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1
3.1.1
3.1.2
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.2
3.2.1
3.2.2
3.2.3
3.2.4
3.3
n2.*
n2.8-dev
n2.9-dev
n3.*
n3.1-dev
n3.2-dev
n3.3-dev
n3.4-dev
Database specific
vanir_signatures
[
{
"target": {
"file": "libavcodec/cdxl.c",
"function": "cdxl_decode_frame"
},
"deprecated": false,
"id": "CVE-2017-9996-2f0ad500",
"signature_version": "v1",
"digest": {
"function_hash": "232012547363536280629733976652993635058",
"length": 2357.0
},
"signature_type": "Function",
"source": "https://github.com/ffmpeg/ffmpeg/commit/e1b60aad77c27ed5d4dfc11e5e6a05a38c70489d"
},
{
"target": {
"file": "libavcodec/cdxl.c"
},
"deprecated": false,
"id": "CVE-2017-9996-c0e84502",
"signature_version": "v1",
"digest": {
"line_hashes": [
"9541136662425234999368121051517161174",
"335429220255434529045940017495389620699",
"282632619432198648312553285132640172496",
"117934805132091481606501704046257057968"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://github.com/ffmpeg/ffmpeg/commit/e1b60aad77c27ed5d4dfc11e5e6a05a38c70489d"
}
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-9996.json"
vanir_signatures_modified
"2026-08-17T05:26:01Z"