|Description||The update_dimensions function in libavcodec/vp8.c in FFmpeg through 2.8.1, as used in Google Chrome before 46.0.2490.71 and other products, relies on a coefficient-partition count during multi-threaded operation, which allows remote attackers to cause a denial of service (race condition and memory corruption) or possibly have unspecified other impact via a crafted WebM file.|
|Source||CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)|
|NVD severity||medium (attack range: remote)|
Vulnerable and fixed packages
The table below lists information on source packages.
|chromium-browser (PTS)||wheezy, wheezy (security)||37.0.2062.120-1~deb7u1||vulnerable|
|jessie (security), jessie||57.0.2987.98-1~deb8u1||fixed|
|stretch (security), stretch||61.0.3163.100-1~deb9u1||fixed|
|jessie (security), jessie||6:11.9-1~deb8u1||undetermined|
The information below is based on the following data on fixed versions.
[squeeze] - ffmpeg <end-of-life> (Not supported in Squeeze LTS)
[wheezy] - libav <not-affected> (Vulnerable code not present)
Starting with 44.0.2403.157-1 chromium uses the ffmpeg system copy
It looks like this relates to multithreaded decoding of VPx codecs, which is not implemented in the squeeze version. But I'm not sure as the second bug report is still private.