ByteOS Network

NVD Vulnerability Details :

CVE-2017-1000460

Modified

Source-cve@mitre.org

Published At-03 Jan, 2018 | 20:29

Updated At-31 Mar, 2019 | 02:29

In line libavcodec/h264dec.c:500 in libav(v13_dev0), ffmpeg(n3.4), chromium(56 prior Feb 13, 2017), the return value of init_get_bits is ignored and get_ue_golomb(&gb) is called on an uninitialized get_bits context, which causes a NULL deref exception.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	6.5	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Primary	2.0	4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:N/A:P

CPE Matches

libav>>libav>>13_dev0

cpe:2.3:a:libav:libav:13_dev0:*:*:*:*:*:*:*

FFmpeg

>>ffmpeg>>3.4

cpe:2.3:a:ffmpeg:ffmpeg:3.4:*:*:*:*:*:*:*

Google LLC

>>chrome>>Versions up to 56.0.2924(inclusive)

cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-476	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
https://bugzilla.libav.org/show_bug.cgi?id=952	cve@mitre.org	Exploit Issue Tracking Third Party Advisory
https://chromium.googlesource.com/chromium/third_party/ffmpeg/+/8e313ca08800178efce00045e07dc494d437b70c	cve@mitre.org	Issue Tracking Patch
https://lists.debian.org/debian-lts-announce/2019/03/msg00041.html	cve@mitre.org	N/A
https://lists.ffmpeg.org/pipermail/ffmpeg-cvslog/2017-January/104221.html	cve@mitre.org	Issue Tracking Patch

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History