CVE-2016-7555 — Sensitive Information Exposure in Ffmpeg

CWE-200 — Sensitive Information Exposure4 documents4 sources

Severity

5.5MEDIUMNVD

EPSS

0.3%

top 43.89%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Ffmpeg Debian Ffmpeg

Timeline

PublishedDec 23

Latest updateMay 17

Description

The avi_read_header function in libavformat/avidec.c in FFmpeg before 3.1.4 is vulnerable to memory leak when decoding an AVI file that has a crafted "strh" structure.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages3 packages

▶debiandebian/ffmpeg< ffmpeg 7:3.1.4-1 (bookworm)

▶Debianffmpeg/ffmpeg< 7:3.1.4-1+3

▶NVDffmpeg/ffmpeg3.1.3

🔴Vulnerability Details

GHSA

GHSA-vgvg-3jgx-pfjc: The avi_read_header function in libavformat/avidec↗2022-05-17

▶

OSV

CVE-2016-7555: The avi_read_header function in libavformat/avidec↗2016-12-23

▶

📋Vendor Advisories

Debian

CVE-2016-7555: ffmpeg - The avi_read_header function in libavformat/avidec.c in FFmpeg before 3.1.4 is v...↗2016

▶