CVE-2016-10192
published 2017-02-09CVE-2016-10192: Heap-based buffer overflow in ffserver.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote attackers to…
PriorityP355critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
6.55%
93.8th percentile
Heap-based buffer overflow in ffserver.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote attackers to execute arbitrary code by leveraging failure to check chunk size.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ffmpeg | < ffmpeg 7:3.2.2-1 (bookworm) | ffmpeg 7:3.2.2-1 (bookworm) |
| ffmpeg | ffmpeg | <= 2.8.9 | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | >= 0 < 7:3.2.2-1 | 7:3.2.2-1 |
| ffmpeg | ffmpeg | >= 0 < 7:3.2.2-1 | 7:3.2.2-1 |
| ffmpeg | ffmpeg | >= 0 < 7:3.2.2-1 | 7:3.2.2-1 |
| ffmpeg | ffmpeg | >= 0 < 7:3.2.2-1 | 7:3.2.2-1 |
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-gmhg-h539-229j: Heap-based buffer overflow in ffserver
ghsa_unreviewed·2022-05-17
CVE-2016-10192 [CRITICAL] CWE-119 GHSA-gmhg-h539-229j: Heap-based buffer overflow in ffserver
Heap-based buffer overflow in ffserver.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote attackers to execute arbitrary code by leveraging failure to check chunk size.
OSV
CVE-2016-10192: Heap-based buffer overflow in ffserver
osv·2017-02-09·CVSS 9.8
CVE-2016-10192 [CRITICAL] CVE-2016-10192: Heap-based buffer overflow in ffserver
Heap-based buffer overflow in ffserver.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote attackers to execute arbitrary code by leveraging failure to check chunk size.
Debian
CVE-2016-10192: ffmpeg - Heap-based buffer overflow in ffserver.c in FFmpeg before 2.8.10, 3.0.x before 3...
vendor_debian·2016·CVSS 9.8
CVE-2016-10192 [CRITICAL] CVE-2016-10192: ffmpeg - Heap-based buffer overflow in ffserver.c in FFmpeg before 2.8.10, 3.0.x before 3...
Heap-based buffer overflow in ffserver.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote attackers to execute arbitrary code by leveraging failure to check chunk size.
Scope: local
bookworm: resolved (fixed in 7:3.2.2-1)
bullseye: resolved (fixed in 7:3.2.2-1)
forky: resolved (fixed in 7:3.2.2-1)
sid: resolved (fixed in 7:3.2.2-1)
trixie: resolved (fixed in 7:3.2.2-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.openwall.com/lists/oss-security/2017/01/31/12http://www.openwall.com/lists/oss-security/2017/02/02/1http://www.securityfocus.com/bid/95991https://ffmpeg.org/security.htmlhttps://github.com/FFmpeg/FFmpeg/commit/a5d25faa3f4b18dac737fdb35d0dd68eb0dc2156http://www.openwall.com/lists/oss-security/2017/01/31/12http://www.openwall.com/lists/oss-security/2017/02/02/1http://www.securityfocus.com/bid/95991https://ffmpeg.org/security.htmlhttps://github.com/FFmpeg/FFmpeg/commit/a5d25faa3f4b18dac737fdb35d0dd68eb0dc2156
2017-02-09
Published