SB2018010312 - NULL pointer dereference in Libav
Published: January 3, 2018 Updated: August 8, 2020
Security Bulletin ID
SB2018010312
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) NULL pointer dereference (CVE-ID: CVE-2017-1000460)
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
In line libavcodec/h264dec.c:500 in libav(v13_dev0), ffmpeg(n3.4), chromium(56 prior Feb 13, 2017), the return value of init_get_bits is ignored and get_ue_golomb(&gb) is called on an uninitialized get_bits context, which causes a NULL deref exception.
Remediation
Install update from vendor's website.