CVE-2016-10192

published 2017-02-09

CVE-2016-10192: Heap-based buffer overflow in ffserver.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote attackers to…

Priority P3 54 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

Heap-based buffer overflow in ffserver.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote attackers to execute arbitrary code by leveraging failure to check chunk size.

Affected

19 ranges

Vendor	Product	Version range	Fixed in
debian	ffmpeg	< ffmpeg 7:3.2.2-1 (bookworm)	ffmpeg 7:3.2.2-1 (bookworm)
ffmpeg	ffmpeg	<= 2.8.9	—
ffmpeg	ffmpeg	—	—
ffmpeg	ffmpeg	—	—
ffmpeg	ffmpeg	—	—
ffmpeg	ffmpeg	—	—
ffmpeg	ffmpeg	—	—
ffmpeg	ffmpeg	—	—
ffmpeg	ffmpeg	—	—
ffmpeg	ffmpeg	—	—
ffmpeg	ffmpeg	—	—
ffmpeg	ffmpeg	—	—
ffmpeg	ffmpeg	—	—
ffmpeg	ffmpeg	—	—
ffmpeg	ffmpeg	—	—
ffmpeg	ffmpeg	>= 0 < 7:3.2.2-1	7:3.2.2-1
ffmpeg	ffmpeg	>= 0 < 7:3.2.2-1	7:3.2.2-1
ffmpeg	ffmpeg	>= 0 < 7:3.2.2-1	7:3.2.2-1
ffmpeg	ffmpeg	>= 0 < 7:3.2.2-1	7:3.2.2-1

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

osv 9.8 CRITICAL

vendor_debian 9.8 CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-119