Main Vulnerability Database Vulnerabilities #VU37710

NULL pointer dereference in FFmpeg and Libav - CVE-2017-1000460

Published: January 3, 2018 / Updated: August 8, 2020

Vulnerability identifier: #VU37710

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-1000460

CWE-ID: CWE-476

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

In line libavcodec/h264dec.c:500 in libav(v13_dev0), ffmpeg(n3.4), chromium(56 prior Feb 13, 2017), the return value of init_get_bits is ignored and get_ue_golomb(&gb) is called on an uninitialized get_bits context, which causes a NULL deref exception.

Affected software

FFmpeg
Libav

How to mitigate CVE-2017-1000460

Install update from vendor's website.

External References

Related Security Bulletins