SOL03202240 - FFmpeg vulnerabilities CVE-2016-1897 and CVE-2016-1898

CVE-2016-1897 FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol in an HTTP Live Streaming HLS M3U8 file, leading to an external HTTP request in which the URL string contains the first line of a local file. CVE-2016-1898: FFmpe...

FreeBSD : ffmpeg -- remote denial of service in JPEG2000 decoder (6ac79ed8-ccc2-11e5-932b-5404a68ad561)

FFmpeg security reports : FFmpeg 2.8.6 fixes the following vulnerabilities : CVE-2016-2213 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018 Jacques Vidrine and...

The vulnerability of Google Chrome browser allows a perpetrator to trigger a service failure or cause some other unspecified effect.

The vulnerability of the VideoFramePool::PoolImpl::CreateFrame function in the media/base/videoframepool.cc module of the Google Chrome browser is related to memory initialization errors for the video-frame data structure. Exploiting this vulnerability may allow a remote attacker to cause service...

DEBIAN-CVE-2016-2213

The jpeg2000decodetile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.8.6 allows remote attackers to cause a denial of service out-of-bounds array read access via crafted JPEG 2000 data...

Out-of-bounds

The jpeg2000decodetile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.8.6 allows remote attackers to cause a denial of service out-of-bounds array read access via crafted JPEG 2000 data...

CVE-2016-2213

The jpeg2000decodetile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.8.6 allows remote attackers to cause a denial of service out-of-bounds array read access via crafted JPEG 2000 data...

CVE-2016-2213

The jpeg2000decodetile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.8.6 allows remote attackers to cause a denial of service out-of-bounds array read access via crafted JPEG 2000 data...

ALPINE-CVE-2016-2213

The jpeg2000decodetile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.8.6 allows remote attackers to cause a denial of service out-of-bounds array read access via crafted JPEG 2000 data...

CVE-2016-2213

The jpeg2000decodetile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.8.6 allows remote attackers to cause a denial of service out-of-bounds array read access via crafted JPEG 2000 data...

CVE-2016-2213

The jpeg2000decodetile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.8.6 allows remote attackers to cause a denial of service out-of-bounds array read access via crafted JPEG 2000 data...

openSUSE: Security Advisory for ffmpeg (openSUSE-SU-2016:0243-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE: Security Advisory for ffmpeg (openSUSE-SU-2016:0089-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE Security Update : ffmpeg (openSUSE-2016-94)

This update to ffmpeg 2.8.5 fixes the following issues : - CVE-2016-1897: Cross-origin issue in URL processing concat - local file disclosure boo961937 - CVE-2016-1898: Cross-origin issue in URL processing subfile - local file disclosure boo961937 %NASLMINLEVEL 70300 C Tenable Network Security,...

ffmpeg -- remote denial of service in JPEG2000 decoder

FFmpeg security reports: FFmpeg 2.8.6 fixes the following vulnerabilities: CVE-2016-2213...

Security update for ffmpeg (important)

This update to ffmpeg 2.8.5 fixes the following issues: CVE-2016-1897: Cross-origin issue in URL processing concat - local file disclosure boo961937 CVE-2016-1898: Cross-origin issue in URL processing subfile - local file disclosure boo961937...

openSUSE Security Update : ffmpeg (openSUSE-2016-26)

This update to ffmpeg 2.8.4 fixes the following issues : - CVE-2015-8661: Denial of service via crafted .mov file boo960385 - CVE-2015-8662: Denial of service via crafted JPEG 2000 data boo960384 - CVE-2015-8663: Denial of service via crafted H.264 data boo960383 %NASLMINLEVEL 70300 C Tenable...

FreeBSD : ffmpeg -- remote attacker can access local files (046fedd1-bd01-11e5-bbf4-5404a68ad561)

Arch Linux reports : ffmpeg has a vulnerability in the current version that allows the attacker to create a specially crafted video file, downloading which will send files from a user PC to a remote attacker server. The attack does not even require the user to open that file -- for example, KDE...

ffmpeg: information leakage

A vulnerability in the way FFmpeg handles the concat CVE-2016-1897 and subfile CVE-2016-1898 protocols in a HTTP Live Streaming HLS M3U8 file allows a remote attacker to conduct a cross-origin attacks, and to access arbitrary local files on the vulnerable host. The attack uses a crafted M3U8 file...

FFmpeg and Libav Information Disclosure Vulnerability (CNVD-2016-00259)

FFmpeg is a complete solution for recording, converting and streaming audio and video.Libav is a cross-platform solution for recording and converting audio and video from the Libav team that includes a libavcodec encoder. A security vulnerability exists in FFmpeg and Libav that can be exploited b...

FFmpeg and Libav Information Disclosure Vulnerability

FFmpeg is a complete solution for recording, converting and streaming audio and video.Libav is a cross-platform solution for recording and converting audio and video from the Libav team that includes a libavcodec encoder. A security vulnerability exists in FFmpeg and Libav that can be exploited b...