CVE-2017-9996

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2017-9996
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-9996.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2017-9996
Downstream
Related
Published
2017-06-28T06:29:00.613Z
Modified
2026-03-15T14:30:06.169514Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

The cdxldecodeframe function in libavcodec/cdxl.c in FFmpeg 2.8.x before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 does not exclude the CHUNKY format, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.

References

Affected packages

Git / github.com/ffmpeg/ffmpeg

Affected ranges

Type
GIT
Repo
https://github.com/ffmpeg/ffmpeg
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
58142a27ea96bf9246586a91a82db85e37646933
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
40934e0e9b632fa6c6ec22ac03b530625a027c79
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
c9b3451da3cf632424c07c35759c9ffbd537fa9e
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
644296e736ee219cd02f7b7d7b7b4c7c5a464217
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
644179e0d4155ae8f5ddd5c3f6bd003e2e13cf94
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
b8fa3ff95d884060f39c5d50e811404fe94b9301
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
af21d609a0ddeeddad4fdefecb19fd4e13744f80
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
da4ea971617351600f49437bc9d489e650b4de38
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
d828aabf0343452a76547239832e27045be92549
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
fb93771072cfcbdd523d9f4bcd7682ee8b7f5578
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
16c0d8aa46b6a206d14f1d1010b7487809d54e5f
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
523da8eac176c241881a9177237f8bf60e8d7b75
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
c40983a6f631d22fede713d535bb9c31d5c9740c
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
fda00aa7749326f02a6ca0a7d9bd9bcda1054071
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
c66f4d1ae64dffaf456d05cbdade02054446f499
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
3512ed3622e1200f03e0d508b5c1bcbf9f5d2c88
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
5771a0c8237d6fb0fb65877126ec0f7842fd2a1e
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
b408dba231091cd7f465ddf8bd8babf5b7efe63a
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
e8b94e5ce48f0dd68287e8b1c2ef4125fabff1d7
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
c63e58756699d07b5bc69799db388600d3e634bf
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
fbc96c50d72f55131e43939e38c1e5af4315a755
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
ce36e74e75751c721185fbebaa4ee8714b44c5a5
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
4275b27a230008c41c63397871f173952723e2b2
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
c46d22a4a58467bdc7885685b06a2114dd181c43
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
c2ea70628215ccede53240843b4514a6c339ab27
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
2a5c41e3e4a7e763503af59de903d5649dcc071a
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
e08b1cf2df8cfdb3394aa5ab0320739f8b5a1c4f
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
384d90f26800521440a1d64d7c6967e9b552a690
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
340cea9f22c162e10d120835661e132721b7454b
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
c269c43a83166003ab6649263bc60634a6b7866f
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
148c4fb8d203fdef8589ccef56a995724938918b
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
68ed682710f1cb1f4fdd1fd0447f402d6feabd01
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
d4b731e271ba944ade8f6a128271479529507de9
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
efa89a841941bf61d1a3eb5c2900f98e3e7db85b
Fixed
1e42736b95065c69a7481d0cf55247024f54b660
Fixed
e1b60aad77c27ed5d4dfc11e5e6a05a38c70489d
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.8"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.8.1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.8.2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.8.3"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.8.4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.8.5"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.8.6"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.8.7"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.8.8"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.8.9"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.8.10"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.8.11"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.0.1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.0.2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.0.3"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.0.4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.0.5"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.0.6"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.0.7"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.1.1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.1.2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.1.3"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.1.4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.1.5"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.1.6"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.1.7"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.2.1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.2.2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.2.3"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.2.4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.3"
        }
    ]
}

Affected versions

Other
N
n0.*
n0.11-dev
n0.12-dev
n0.8
n1.*
n1.1-dev
n1.2-dev
n1.3-dev
n2.*
n2.0
n2.1-dev
n2.2-dev
n2.3-dev
n2.4-dev
n2.5-dev
n2.6-dev
n2.7-dev
n2.8-dev
n2.9-dev
n3.*
n3.1-dev
n3.2-dev
n3.3-dev
n3.4-dev

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-9996.json"
vanir_signatures 
[
    {
        "id": "CVE-2017-9996-2f0ad500",
        "signature_type": "Function",
        "digest": {
            "function_hash": "232012547363536280629733976652993635058",
            "length": 2357.0
        },
        "target": {
            "file": "libavcodec/cdxl.c",
            "function": "cdxl_decode_frame"
        },
        "source": "https://github.com/ffmpeg/ffmpeg/commit/e1b60aad77c27ed5d4dfc11e5e6a05a38c70489d",
        "signature_version": "v1",
        "deprecated": false
    },
    {
        "id": "CVE-2017-9996-7fcd8b63",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "253968693662442934354663313725314224920",
                "155954498066262174679898175888474969919",
                "271068582030536723487794266941703843721",
                "22086510837230335350562603478408771661"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "libavcodec/cdxl.c"
        },
        "source": "https://github.com/ffmpeg/ffmpeg/commit/1e42736b95065c69a7481d0cf55247024f54b660",
        "signature_version": "v1",
        "deprecated": false
    },
    {
        "id": "CVE-2017-9996-c0e84502",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "9541136662425234999368121051517161174",
                "335429220255434529045940017495389620699",
                "282632619432198648312553285132640172496",
                "117934805132091481606501704046257057968"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "libavcodec/cdxl.c"
        },
        "source": "https://github.com/ffmpeg/ffmpeg/commit/e1b60aad77c27ed5d4dfc11e5e6a05a38c70489d",
        "signature_version": "v1",
        "deprecated": false
    },
    {
        "id": "CVE-2017-9996-cf24cf4d",
        "signature_type": "Function",
        "digest": {
            "function_hash": "218522419038422982971272059869302486306",
            "length": 2384.0
        },
        "target": {
            "file": "libavcodec/cdxl.c",
            "function": "cdxl_decode_frame"
        },
        "source": "https://github.com/ffmpeg/ffmpeg/commit/1e42736b95065c69a7481d0cf55247024f54b660",
        "signature_version": "v1",
        "deprecated": false
    }
]