Lucene search

K
osvGoogleOSV:DLA-464-1
HistoryMay 10, 2016 - 12:00 a.m.

libav - security update

2016-05-1000:00:00
Google
osv.dev
10

EPSS

0.009

Percentile

82.4%

It was discovered that there was a use-after free vulnerability in
libav, a multimedia player, server, encoder and transcoder library.

The seg_write_packet function in libavformat/segment.c in ffmpeg
2.1.4 and earlier does not free the correct memory location, which
allows remote attackers to cause a denial of service (“invalid
memory handler”) and possibly execute arbitrary code via a crafted
video that triggers a use after free.

For Debian 7 Wheezy, this issue has been fixed in libav version
6:0.8.17-2+deb7u1.

We recommend that you upgrade your libav packages.