Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 626360 (CVE-2017-11665) - <media-video/ffmpeg-3.3.3: denial of service via a crafted stream (CVE-2017-11665)
Summary: <media-video/ffmpeg-3.3.3: denial of service via a crafted stream (CVE-2017-1...
Alias: CVE-2017-11665
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
Whiteboard: B3 [noglsa cve]
Depends on: CVE-2017-11399
  Show dependency tree
Reported: 2017-07-27 13:47 UTC by Aleksandr Wagner (Kivak)
Modified: 2017-10-26 00:39 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Aleksandr Wagner (Kivak) 2017-07-27 13:47:38 UTC
CVE-2017-11665 (

The ff_amf_get_field_value function in libavformat/rtmppkt.c in FFmpeg 3.3.2 allows remote RTMP servers to cause a denial of service (Segmentation Violation and application crash) via a crafted stream. 

Comment 1 Alexis Ballier gentoo-dev 2017-07-30 14:28:13 UTC
that gist is a 404
Comment 2 Christopher Díaz Riveros (RETIRED) gentoo-dev Security 2017-07-30 15:01:21 UTC
This is the commit where that issue is fixed

Security Project Padawan
Comment 3 Alexis Ballier gentoo-dev 2017-07-30 15:32:20 UTC
ok, so 3.3.3 has the fix and we can track stabilization in bug #626414
Comment 4 Aaron Bauman (RETIRED) gentoo-dev 2017-10-26 00:39:04 UTC
GLSA Vote: No

Cleanup handled in bug #630460