Lucene search

MitreCVE-2017-9991

HistoryJun 28, 2017 - 6:29 a.m.

CVE-2017-9991

2017-06-2806:29:00

CWE-119

mitre

web.nvd.nist.gov

cve-2017-9991

nvd

ffmpeg

buffer overflow

denial of service

remote attack

security vulnerability

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.2

Confidence

High

EPSS

0.002

Percentile

60.1%

JSON

Heap-based buffer overflow in the xwd_decode_frame function in libavcodec/xwddec.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file.

Affected configurations

Nvd

Node

ffmpegffmpegRange≤2.8.11

ffmpegffmpegMatch3.0

ffmpegffmpegMatch3.0.1

ffmpegffmpegMatch3.0.2

ffmpegffmpegMatch3.0.3

ffmpegffmpegMatch3.0.4

ffmpegffmpegMatch3.0.5

ffmpegffmpegMatch3.0.6

ffmpegffmpegMatch3.0.7

ffmpegffmpegMatch3.1

ffmpegffmpegMatch3.1.1

ffmpegffmpegMatch3.1.2

ffmpegffmpegMatch3.1.3

ffmpegffmpegMatch3.1.4

ffmpegffmpegMatch3.1.5

ffmpegffmpegMatch3.1.6

ffmpegffmpegMatch3.1.7

ffmpegffmpegMatch3.2

ffmpegffmpegMatch3.2.1

ffmpegffmpegMatch3.2.2

ffmpegffmpegMatch3.2.3

ffmpegffmpegMatch3.2.4

ffmpegffmpegMatch3.3

VendorProductVersionCPE
ffmpegffmpeg*cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*
ffmpegffmpeg3.0cpe:2.3:a:ffmpeg:ffmpeg:3.0:*:*:*:*:*:*:*
ffmpegffmpeg3.0.1cpe:2.3:a:ffmpeg:ffmpeg:3.0.1:*:*:*:*:*:*:*
ffmpegffmpeg3.0.2cpe:2.3:a:ffmpeg:ffmpeg:3.0.2:*:*:*:*:*:*:*
ffmpegffmpeg3.0.3cpe:2.3:a:ffmpeg:ffmpeg:3.0.3:*:*:*:*:*:*:*
ffmpegffmpeg3.0.4cpe:2.3:a:ffmpeg:ffmpeg:3.0.4:*:*:*:*:*:*:*
ffmpegffmpeg3.0.5cpe:2.3:a:ffmpeg:ffmpeg:3.0.5:*:*:*:*:*:*:*
ffmpegffmpeg3.0.6cpe:2.3:a:ffmpeg:ffmpeg:3.0.6:*:*:*:*:*:*:*
ffmpegffmpeg3.0.7cpe:2.3:a:ffmpeg:ffmpeg:3.0.7:*:*:*:*:*:*:*
ffmpegffmpeg3.1cpe:2.3:a:ffmpeg:ffmpeg:3.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ffmpeg	ffmpeg	*	cpe:2.3:a:ffmpeg:ffmpeg::::::::
ffmpeg	ffmpeg	3.0	cpe:2.3:a:ffmpeg:ffmpeg:3.0:::::::*
ffmpeg	ffmpeg	3.0.1	cpe:2.3:a:ffmpeg:ffmpeg:3.0.1:::::::*
ffmpeg	ffmpeg	3.0.2	cpe:2.3:a:ffmpeg:ffmpeg:3.0.2:::::::*
ffmpeg	ffmpeg	3.0.3	cpe:2.3:a:ffmpeg:ffmpeg:3.0.3:::::::*
ffmpeg	ffmpeg	3.0.4	cpe:2.3:a:ffmpeg:ffmpeg:3.0.4:::::::*
ffmpeg	ffmpeg	3.0.5	cpe:2.3:a:ffmpeg:ffmpeg:3.0.5:::::::*
ffmpeg	ffmpeg	3.0.6	cpe:2.3:a:ffmpeg:ffmpeg:3.0.6:::::::*
ffmpeg	ffmpeg	3.0.7	cpe:2.3:a:ffmpeg:ffmpeg:3.0.7:::::::*
ffmpeg	ffmpeg	3.1	cpe:2.3:a:ffmpeg:ffmpeg:3.1:::::::*