CVE-2016-10191

Name	CVE-2016-10191
Description	Heap-based buffer overflow in libavformat/rtmppkt.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote attackers to execute arbitrary code by leveraging failure to check for RTMP packet size mismatches.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-1611-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
ffmpeg (PTS)	bullseye	7:4.3.7-0+deb11u1	fixed
	bullseye (security)	7:4.3.8-0+deb11u1	fixed
	bookworm, bookworm (security)	7:5.1.6-0+deb12u1	fixed
	sid, trixie	7:7.1-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
ffmpeg	source	(unstable)	7:3.2.2-1
libav	source	jessie	6:11.12-1~deb8u2	DLA-1611-1
libav	source	(unstable)	(unfixed)

Patch: https://github.com/FFmpeg/FFmpeg/commit/7d57ca4d9a75562fa32e40766211de150f8b3ee7
https://www.openwall.com/lists/oss-security/2017/01/31/12