Multiple vulnerabilities in Libav



Published: 2017-03-21 | Updated: 2020-08-08
Risk Medium
Patch available NO
Number of vulnerabilities 3
CVE-ID CVE-2017-5984
CVE-2017-7206
CVE-2017-7208
CWE-ID CWE-125
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe 		Libav
Client/Desktop applications / Multimedia software

Vendor Libav

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Out-of-bounds read

EUVDB-ID: #VU35885

Risk: Medium

CVSSv3.1: 6 [AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:U/RC:C]

CVE-ID: CVE-2017-5984

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to heap-based buffer over-read. A remote attacker can perform a denial of service attack.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Libav: 9.21

CPE2.3 External links

http://bugzilla.libav.org/show_bug.cgi?id=1019
http://patches.libav.org/patch/62534/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Out-of-bounds read

EUVDB-ID: #VU39420

Risk: Medium

CVSSv3.1: 6.5 [AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H/E:U/RL:U/RC:C]

CVE-ID: CVE-2017-7206

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in The ff_h2645_extract_rbsp function in libavcodec in libav 9.21. A remote attacker can perform a denial of service (heap-based buffer over-read) or obtain sensitive information from process memory via a crafted h264 video file.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Libav: 9.21

CPE2.3 External links

http://www.securityfocus.com/bid/97006
http://bugzilla.libav.org/show_bug.cgi?id=1002


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Out-of-bounds read

EUVDB-ID: #VU39421

Risk: Medium

CVSSv3.1: 6.5 [AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H/E:U/RL:U/RC:C]

CVE-ID: CVE-2017-7208

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in The decode_residual function in libavcodec in libav 9.21. A remote attacker can perform a denial of service (buffer over-read) or obtain sensitive information from process memory via a crafted h264 video file.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Libav: 9.21

CPE2.3 External links

http://www.debian.org/security/2017/dsa-4012
http://www.securityfocus.com/bid/97005
http://bugzilla.libav.org/show_bug.cgi?id=1000


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###