Double free error in FFmpeg - CVE-2017-15186
Published: November 28, 2017 / Updated: November 28, 2017
Vulnerability identifier: #VU9429
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-15186
CWE-ID: CWE-415
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The vulnerability exists due to double free error when processing malicious input. A remote attacker can send a specially crafted AVI file, trick the victim into opening it and cause the service to crash.
Successful exploitation of the vulnerability results in denial of service.
Affected software
FFmpeg
ffmpeg (Alpine package)
ffmpeg (Alpine package)
How to mitigate CVE-2017-15186
Update to version 3.4.
ffmpeg (Alpine package) - update to 3.1.11-r1