CVE-2017-9996
- Source
- https://cve.org/CVERecord?id=CVE-2017-9996
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-9996.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2017-9996
- Downstream
- Published
- 2017-06-28T06:29:00Z
- Modified
- 2026-11-07T13:28:02Z
- Severity
-
- 7.8 (High) CVSS_V3 - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
The cdxl_decode_frame function in libavcodec/cdxl.c in FFmpeg 2.8.x before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 does not exclude the CHUNKY format, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.
- References
-
- http://www.securityfocus.com/bid/99323
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1378
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1427
- https://github.com/FFmpeg/FFmpeg/commit/1e42736b95065c69a7481d0cf55247024f54b660
- https://github.com/FFmpeg/FFmpeg/commit/e1b60aad77c27ed5d4dfc11e5e6a05a38c70489d
Affected packages
Git / git.ffmpeg.org/ffmpeg.git
Affected ranges
- Type
- GIT
- Repo
- https://git.ffmpeg.org/ffmpeg.git
- Events
-
IntroducedLast Affected
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:2.8:*:*:*:*:*:*:*", "range": [ { "introduced": "2.8" }, { "last_affected": "2.8" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:2.8.1:*:*:*:*:*:*:*", "range": [ { "introduced": "2.8.1" }, { "last_affected": "2.8.1" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:2.8.2:*:*:*:*:*:*:*", "range": [ { "introduced": "2.8.2" }, { "last_affected": "2.8.2" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:2.8.3:*:*:*:*:*:*:*", "range": [ { "introduced": "2.8.3" }, { "last_affected": "2.8.3" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:2.8.4:*:*:*:*:*:*:*", "range": [ { "introduced": "2.8.4" }, { "last_affected": "2.8.4" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:2.8.5:*:*:*:*:*:*:*", "range": [ { "introduced": "2.8.5" }, { "last_affected": "2.8.5" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:2.8.6:*:*:*:*:*:*:*", "range": [ { "introduced": "2.8.6" }, { "last_affected": "2.8.6" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:2.8.7:*:*:*:*:*:*:*", "range": [ { "introduced": "2.8.7" }, { "last_affected": "2.8.7" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:2.8.8:*:*:*:*:*:*:*", "range": [ { "introduced": "2.8.8" }, { "last_affected": "2.8.8" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:2.8.9:*:*:*:*:*:*:*", "range": [ { "introduced": "2.8.9" }, { "last_affected": "2.8.9" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:2.8.10:*:*:*:*:*:*:*", "range": [ { "introduced": "2.8.10" }, { "last_affected": "2.8.10" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:2.8.11:*:*:*:*:*:*:*", "range": [ { "introduced": "2.8.11" }, { "last_affected": "2.8.11" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.0:*:*:*:*:*:*:*", "range": [ { "introduced": "3.0" }, { "last_affected": "3.0" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.0.1:*:*:*:*:*:*:*", "range": [ { "introduced": "3.0.1" }, { "last_affected": "3.0.1" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.0.2:*:*:*:*:*:*:*", "range": [ { "introduced": "3.0.2" }, { "last_affected": "3.0.2" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.0.3:*:*:*:*:*:*:*", "range": [ { "introduced": "3.0.3" }, { "last_affected": "3.0.3" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.0.4:*:*:*:*:*:*:*", "range": [ { "introduced": "3.0.4" }, { "last_affected": "3.0.4" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.0.5:*:*:*:*:*:*:*", "range": [ { "introduced": "3.0.5" }, { "last_affected": "3.0.5" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.0.6:*:*:*:*:*:*:*", "range": [ { "introduced": "3.0.6" }, { "last_affected": "3.0.6" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.0.7:*:*:*:*:*:*:*", "range": [ { "introduced": "3.0.7" }, { "last_affected": "3.0.7" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.1:*:*:*:*:*:*:*", "range": [ { "introduced": "3.1" }, { "last_affected": "3.1" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.1.1:*:*:*:*:*:*:*", "range": [ { "introduced": "3.1.1" }, { "last_affected": "3.1.1" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.1.2:*:*:*:*:*:*:*", "range": [ { "introduced": "3.1.2" }, { "last_affected": "3.1.2" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.1.3:*:*:*:*:*:*:*", "range": [ { "introduced": "3.1.3" }, { "last_affected": "3.1.3" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.1.4:*:*:*:*:*:*:*", "range": [ { "introduced": "3.1.4" }, { "last_affected": "3.1.4" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.1.5:*:*:*:*:*:*:*", "range": [ { "introduced": "3.1.5" }, { "last_affected": "3.1.5" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.1.6:*:*:*:*:*:*:*", "range": [ { "introduced": "3.1.6" }, { "last_affected": "3.1.6" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.1.7:*:*:*:*:*:*:*", "range": [ { "introduced": "3.1.7" }, { "last_affected": "3.1.7" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.2:*:*:*:*:*:*:*", "range": [ { "introduced": "3.2" }, { "last_affected": "3.2" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.2.1:*:*:*:*:*:*:*", "range": [ { "introduced": "3.2.1" }, { "last_affected": "3.2.1" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.2.2:*:*:*:*:*:*:*", "range": [ { "introduced": "3.2.2" }, { "last_affected": "3.2.2" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.2.3:*:*:*:*:*:*:*", "range": [ { "introduced": "3.2.3" }, { "last_affected": "3.2.3" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.2.4:*:*:*:*:*:*:*", "range": [ { "introduced": "3.2.4" }, { "last_affected": "3.2.4" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.3:*:*:*:*:*:*:*", "range": [ { "introduced": "3.3" }, { "last_affected": "3.3" } ], "source": "CPE_STRING" } ] }
Git / github.com/ffmpeg/ffmpeg
Affected ranges
- Type
- GIT
- Repo
- https://github.com/ffmpeg/ffmpeg
- Events
-
IntroducedLast AffectedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:2.8:*:*:*:*:*:*:*", "range": [ { "introduced": "2.8" }, { "last_affected": "2.8" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:2.8.1:*:*:*:*:*:*:*", "range": [ { "introduced": "2.8.1" }, { "last_affected": "2.8.1" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:2.8.2:*:*:*:*:*:*:*", "range": [ { "introduced": "2.8.2" }, { "last_affected": "2.8.2" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:2.8.3:*:*:*:*:*:*:*", "range": [ { "introduced": "2.8.3" }, { "last_affected": "2.8.3" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:2.8.4:*:*:*:*:*:*:*", "range": [ { "introduced": "2.8.4" }, { "last_affected": "2.8.4" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:2.8.5:*:*:*:*:*:*:*", "range": [ { "introduced": "2.8.5" }, { "last_affected": "2.8.5" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:2.8.6:*:*:*:*:*:*:*", "range": [ { "introduced": "2.8.6" }, { "last_affected": "2.8.6" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:2.8.7:*:*:*:*:*:*:*", "range": [ { "introduced": "2.8.7" }, { "last_affected": "2.8.7" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:2.8.8:*:*:*:*:*:*:*", "range": [ { "introduced": "2.8.8" }, { "last_affected": "2.8.8" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:2.8.9:*:*:*:*:*:*:*", "range": [ { "introduced": "2.8.9" }, { "last_affected": "2.8.9" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:2.8.10:*:*:*:*:*:*:*", "range": [ { "introduced": "2.8.10" }, { "last_affected": "2.8.10" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:2.8.11:*:*:*:*:*:*:*", "range": [ { "introduced": "2.8.11" }, { "last_affected": "2.8.11" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.0:*:*:*:*:*:*:*", "range": [ { "introduced": "3.0" }, { "last_affected": "3.0" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.0.1:*:*:*:*:*:*:*", "range": [ { "introduced": "3.0.1" }, { "last_affected": "3.0.1" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.0.2:*:*:*:*:*:*:*", "range": [ { "introduced": "3.0.2" }, { "last_affected": "3.0.2" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.0.3:*:*:*:*:*:*:*", "range": [ { "introduced": "3.0.3" }, { "last_affected": "3.0.3" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.0.4:*:*:*:*:*:*:*", "range": [ { "introduced": "3.0.4" }, { "last_affected": "3.0.4" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.0.5:*:*:*:*:*:*:*", "range": [ { "introduced": "3.0.5" }, { "last_affected": "3.0.5" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.0.6:*:*:*:*:*:*:*", "range": [ { "introduced": "3.0.6" }, { "last_affected": "3.0.6" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.0.7:*:*:*:*:*:*:*", "range": [ { "introduced": "3.0.7" }, { "last_affected": "3.0.7" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.1:*:*:*:*:*:*:*", "range": [ { "introduced": "3.1" }, { "last_affected": "3.1" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.1.1:*:*:*:*:*:*:*", "range": [ { "introduced": "3.1.1" }, { "last_affected": "3.1.1" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.1.2:*:*:*:*:*:*:*", "range": [ { "introduced": "3.1.2" }, { "last_affected": "3.1.2" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.1.3:*:*:*:*:*:*:*", "range": [ { "introduced": "3.1.3" }, { "last_affected": "3.1.3" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.1.4:*:*:*:*:*:*:*", "range": [ { "introduced": "3.1.4" }, { "last_affected": "3.1.4" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.1.5:*:*:*:*:*:*:*", "range": [ { "introduced": "3.1.5" }, { "last_affected": "3.1.5" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.1.6:*:*:*:*:*:*:*", "range": [ { "introduced": "3.1.6" }, { "last_affected": "3.1.6" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.1.7:*:*:*:*:*:*:*", "range": [ { "introduced": "3.1.7" }, { "last_affected": "3.1.7" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.2:*:*:*:*:*:*:*", "range": [ { "introduced": "3.2" }, { "last_affected": "3.2" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.2.1:*:*:*:*:*:*:*", "range": [ { "introduced": "3.2.1" }, { "last_affected": "3.2.1" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.2.2:*:*:*:*:*:*:*", "range": [ { "introduced": "3.2.2" }, { "last_affected": "3.2.2" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.2.3:*:*:*:*:*:*:*", "range": [ { "introduced": "3.2.3" }, { "last_affected": "3.2.3" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.2.4:*:*:*:*:*:*:*", "range": [ { "introduced": "3.2.4" }, { "last_affected": "3.2.4" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:3.3:*:*:*:*:*:*:*", "range": [ { "introduced": "3.3" }, { "last_affected": "3.3" } ], "source": "CPE_STRING" }, { "range": [ { "fixed": "1e42736b95065c69a7481d0cf55247024f54b660" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "e1b60aad77c27ed5d4dfc11e5e6a05a38c70489d" } ], "source": "REFERENCES_COMMIT" } ] }
Affected versions
2.*
2.8
2.8.1
2.8.10
2.8.11
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.8.8
2.8.9
3.*
3.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1
3.1.1
3.1.2
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.2
3.2.1
3.2.2
3.2.3
3.2.4
3.3
n2.*
n2.8-dev
n2.9-dev
n3.*
n3.1-dev
n3.2-dev
n3.3-dev
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-9996.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "232012547363536280629733976652993635058",
"length": 2357
},
"id": "CVE-2017-9996-2f0ad500",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/ffmpeg/ffmpeg/commit/e1b60aad77c27ed5d4dfc11e5e6a05a38c70489d",
"target": {
"file": "libavcodec/cdxl.c",
"function": "cdxl_decode_frame"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"253968693662442934354663313725314224920",
"155954498066262174679898175888474969919",
"271068582030536723487794266941703843721",
"22086510837230335350562603478408771661"
],
"threshold": 0.9
},
"id": "CVE-2017-9996-7fcd8b63",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/ffmpeg/ffmpeg/commit/1e42736b95065c69a7481d0cf55247024f54b660",
"target": {
"file": "libavcodec/cdxl.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"9541136662425234999368121051517161174",
"335429220255434529045940017495389620699",
"282632619432198648312553285132640172496",
"117934805132091481606501704046257057968"
],
"threshold": 0.9
},
"id": "CVE-2017-9996-c0e84502",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/ffmpeg/ffmpeg/commit/e1b60aad77c27ed5d4dfc11e5e6a05a38c70489d",
"target": {
"file": "libavcodec/cdxl.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "218522419038422982971272059869302486306",
"length": 2384
},
"id": "CVE-2017-9996-cf24cf4d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/ffmpeg/ffmpeg/commit/1e42736b95065c69a7481d0cf55247024f54b660",
"target": {
"file": "libavcodec/cdxl.c",
"function": "cdxl_decode_frame"
}
}
]
vanir_signatures_modified
"2026-11-07T13:28:02Z"