CVE-2016-6164 — Integer Overflow or Wraparound in Ffmpeg

CWE-190 — Integer Overflow or Wraparound4 documents4 sources
Severity
9.8CRITICALNVD
EPSS
0.9%
top 23.79%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
FfmpegDebian Ffmpeg
Timeline
PublishedJan 23
Latest updateMay 17

Description

Integer overflow in the mov_build_index function in libavformat/mov.c in FFmpeg before 2.8.8, 3.0.x before 3.0.3 and 3.1.x before 3.1.1 allows remote attackers to have unspecified impact via vectors involving sample size.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

▶debiandebian/ffmpeg< ffmpeg 7:3.1.1-1 (bookworm)
▶Debianffmpeg/ffmpeg< 7:3.1.1-1+3
▶NVDffmpeg/ffmpeg2.8.7+4

🔴Vulnerability Details

2
GHSA
GHSA-x4pr-8j2p-f6j2: Integer overflow in the mov_build_index function in libavformat/mov↗2022-05-17
▶
OSV
CVE-2016-6164: Integer overflow in the mov_build_index function in libavformat/mov↗2017-01-23
▶

📋Vendor Advisories

1
Debian
CVE-2016-6164: ffmpeg - Integer overflow in the mov_build_index function in libavformat/mov.c in FFmpeg ...↗2016
▶