CVE-2017-9996

NameCVE-2017-9996
DescriptionThe cdxl_decode_frame function in libavcodec/cdxl.c in FFmpeg 2.8.x before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 does not exclude the CHUNKY format, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
ffmpeg (PTS)buster7:4.1.9-0+deb10u1fixed
buster (security)7:4.1.11-0+deb10u1fixed
bullseye, bullseye (security)7:4.3.6-0+deb11u1fixed
bookworm, bookworm (security)7:5.1.4-0+deb12u1fixed
trixie7:6.1.1-1fixed
sid7:6.1.1-4fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
ffmpegsource(unstable)7:3.2.5-1
libavsource(unstable)(not affected)

Notes

- libav <not-affected> (Vulnerable feature not present)
https://github.com/FFmpeg/FFmpeg/commit/1e42736b95065c69a7481d0cf55247024f54b660
https://github.com/FFmpeg/FFmpeg/commit/e1b60aad77c27ed5d4dfc11e5e6a05a38c70489d
The bug affects FFmpeg's support for CHUNKY cdxl files, a feature that is
not present in Libav. Libav detects CHUNKY files and bails out early.

Search for package or bug name: Reporting problems