Vulnerability Details : CVE-2016-2327
libavcodec/pngenc.c in FFmpeg before 2.8.5 uses incorrect line sizes in certain row calculations, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted .avi file, related to the apng_encode_frame and encode_apng functions.
Vulnerability category: OverflowDenial of service
Products affected by CVE-2016-2327
- cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2016-2327
0.54%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 75 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2016-2327
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST | |
8.8
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST |
CWE ids for CVE-2016-2327
-
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.Assigned by: nvd@nist.gov (Primary)
References for CVE-2016-2327
-
http://git.videolan.org/?p=ffmpeg.git;a=commit;h=8f4c3e4b92212d98f5b9ca2dee13e076effe9589
git.videolan.org Git - ffmpeg.git/commitPatch;Vendor Advisory
-
http://git.videolan.org/?p=ffmpeg.git;a=commit;h=7ec9c5ce8a753175244da971fed9f1e25aef7971
git.videolan.org Git - ffmpeg.git/commitPatch;Vendor Advisory
-
http://www.securitytracker.com/id/1035010
FFmpeg Processing Flaws Lets Remote Users Cause the Target Application or Service to Crash - SecurityTrackerThird Party Advisory;VDB Entry
-
https://security.gentoo.org/glsa/201606-09
FFmpeg: Multiple vulnerabilities (GLSA 201606-09) — Gentoo securityThird Party Advisory;VDB Entry
Jump to