CVE-2016-7424 — NULL Pointer Dereference in Libav

CWE-476 — NULL Pointer Dereference4 documents4 sources
Severity
5.5MEDIUMNVD
EPSS
0.2%
top 52.92%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
LibavDebian LinuxDebian Ffmpeg
Timeline
PublishedOct 7
Latest updateMay 17

Description

The put_no_rnd_pixels8_xy2_mmx function in x86/rnd_template.c in libav 11.7 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted MP3 file.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages3 packages

▶Ubuntulibav/libav< 6:9.20-0ubuntu0.14.04.1+esm1
▶NVDlibav/libav11.7
▶debiandebian/ffmpeg

Also affects: Debian Linux 8.0

🔴Vulnerability Details

2
GHSA
GHSA-67pf-v3gx-9jmp: The put_no_rnd_pixels8_xy2_mmx function in x86/rnd_template↗2022-05-17
▶
OSV
CVE-2016-7424: The put_no_rnd_pixels8_xy2_mmx function in x86/rnd_template↗2016-10-07
▶

📋Vendor Advisories

1
Debian
CVE-2016-7424: ffmpeg - The put_no_rnd_pixels8_xy2_mmx function in x86/rnd_template.c in libav 11.7 and ...↗2016
▶