Bug 626360 (CVE-2017-11665)

Summary:	<media-video/ffmpeg-3.3.3: denial of service via a crafted stream (CVE-2017-11665)
Product:	Gentoo Security	Reporter:	Aleksandr Wagner (Kivak) <alwag>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	herrtimson, media-video
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	B3 [noglsa cve]
Package list:		Runtime testing required:	---
Bug Depends on:	627018
Bug Blocks:

Description Aleksandr Wagner (Kivak) 2017-07-27 13:47:38 UTC

CVE-2017-11665 (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11665):

The ff_amf_get_field_value function in libavformat/rtmppkt.c in FFmpeg 3.3.2 allows remote RTMP servers to cause a denial of service (Segmentation Violation and application crash) via a crafted stream. 

Reference:

https://gist.github.com/singleghost/7d94dda50856e707e1c92d068bbc244e

Comment 1 Alexis Ballier gentoo-dev

2017-07-30 14:28:13 UTC

that gist is a 404

Comment 2 Christopher Díaz Riveros (RETIRED) gentoo-dev

2017-07-30 15:01:21 UTC

This is the commit where that issue is fixed

https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/ffcc82219cef0928bed2d558b19ef6ea35634130

ChrisADR
Security Project Padawan

Comment 3 Alexis Ballier gentoo-dev

2017-07-30 15:32:20 UTC

ok, so 3.3.3 has the fix and we can track stabilization in bug #626414

Comment 4 Aaron Bauman (RETIRED) gentoo-dev

2017-10-26 00:39:04 UTC

GLSA Vote: No

Cleanup handled in bug #630460