Detections
Analytics

Debian DSA-3957-1 : ffmpeg - security update

high Nessus Plugin ID 102807

Language:

Synopsis

The remote Debian host is missing a security-related update.

Description

Several vulnerabilities have been discovered in FFmpeg, a multimedia player, server and encoder. These issues could lead to Denial-of-Service and, in some situation, the execution of arbitrary code.

 - CVE-2017-9608 Yihan Lian of Qihoo 360 GearTeam discovered a NULL pointer access when parsing a crafted MOV file.

 - CVE-2017-9993 Thierry Foucu discovered that it was possible to leak information from files and symlinks ending in common multimedia extensions, using the HTTP Live Streaming.

 - CVE-2017-11399 Liu Bingchang of IIE discovered an integer overflow in the APE decoder that can be triggered by a crafted APE file.

 - CVE-2017-11665 JunDong Xie of Ant-financial Light-Year Security Lab discovered that an attacker able to craft a RTMP stream can crash FFmpeg.

 - CVE-2017-11719 Liu Bingchang of IIE discovered an out-of-bound access that can be triggered by a crafted DNxHD file.

Solution

Upgrade the ffmpeg packages.

For the stable distribution (stretch), these problems have been fixed in version 7:3.2.7-1~deb9u1.

See Also

https://security-tracker.debian.org/tracker/CVE-2017-9608

https://security-tracker.debian.org/tracker/CVE-2017-9993

https://security-tracker.debian.org/tracker/CVE-2017-11399

https://security-tracker.debian.org/tracker/CVE-2017-11665

https://security-tracker.debian.org/tracker/CVE-2017-11719

https://packages.debian.org/source/stretch/ffmpeg

https://www.debian.org/security/2017/dsa-3957

Plugin Details

Severity: High

ID: 102807

File Name: debian_DSA-3957.nasl

Version: 3.4

Type: local

Agent: unix

Published: 8/29/2017

Updated: 1/4/2021

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS v3

Risk Factor: High

Base Score: 7.8

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:ffmpeg, cpe:/o:debian:debian_linux:9.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Patch Publication Date: 8/28/2017

Reference Information

CVE: CVE-2017-11399, CVE-2017-11665, CVE-2017-11719, CVE-2017-9608, CVE-2017-9993

DSA: 3957