CVE-2016-8595 — Improper Input Validation in Ffmpeg

CWE-20 — Improper Input Validation4 documents4 sources

Severity

5.5MEDIUMNVD

EPSS

0.2%

top 52.50%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Ffmpeg Debian Ffmpeg

Timeline

PublishedDec 23

Latest updateMay 17

Description

The gsm_parse function in libavcodec/gsm_parser.c in FFmpeg before 3.1.5 allows remote attackers to cause a denial of service (assert fault) via a crafted AVI file.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages3 packages

▶debiandebian/ffmpeg< ffmpeg 7:3.1.5-1 (bookworm)

▶Debianffmpeg/ffmpeg< 7:3.1.5-1+3

▶NVDffmpeg/ffmpeg3.1.4

🔴Vulnerability Details

GHSA

GHSA-vpwc-mx7r-q9gp: The gsm_parse function in libavcodec/gsm_parser↗2022-05-17

▶

OSV

CVE-2016-8595: The gsm_parse function in libavcodec/gsm_parser↗2016-12-23

▶

📋Vendor Advisories

Debian

CVE-2016-8595: ffmpeg - The gsm_parse function in libavcodec/gsm_parser.c in FFmpeg before 3.1.5 allows ...↗2016

▶