Every CVE Search/ Get API key

CVE-2017-15186

Double free vulnerability in FFmpeg 3.3.4 and earlier allows remote attackers to cause a denial...

6.5 MediumFix available

Double free vulnerability in FFmpeg 3.3.4 and earlier allows remote attackers to cause a denial of service via a crafted AVI file.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.65%Up 0.4 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 6.5

Double free vulnerability in FFmpeg 3.3.4 and earlier allows remote attackers to cause a denial of service via a crafted AVI file.

Record
CVE-2017-15186
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness
CWE-415
Updated
2026-11-02
CVE List No score

Double free vulnerability in FFmpeg 3.3.4 and earlier allows remote attackers to cause a denial of service via a crafted AVI file.

Record
CVE-2017-15186
Updated
2026-11-02
EUVDEUVD-2017-6646 No score

Double free vulnerability in FFmpeg 3.3.4 and earlier allows remote attackers to cause a denial of service via a crafted AVI file.

Record
EUVD-2017-6646
Updated
2026-11-03
GitHub AdvisoriesGHSA-7fhm-w7hc-j7ph 6.5

Double free vulnerability in FFmpeg 3.3.4 and earlier allows remote attackers to cause a denial...

Double free vulnerability in FFmpeg 3.3.4 and earlier allows remote attackers to cause a denial of service via a crafted AVI file.

Record
GHSA-7fhm-w7hc-j7ph
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-415
Updated
2026-11-02
OSVALPINE-CVE-2017-15186 6.5

Double free vulnerability in FFmpeg 3.3.4 and earlier allows remote attackers to cause a denial of service via a crafted AVI file.

Record
ALPINE-CVE-2017-15186
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 6.5

Double free vulnerability in FFmpeg 3.3.4 and earlier allows remote attackers to cause a denial of service via a crafted AVI file.

Record
CVE-2017-15186
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2017-15186 6.5

Double free vulnerability in FFmpeg 3.3.4 and earlier allows remote attackers to cause a denial of service via a crafted AVI file.

Record
DEBIAN-CVE-2017-15186
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVMGASA-2017-0446 No score

Updated ffmpeg packages fix security vulnerability

This update provides ffmpeg version 3.3.5, which fixes several security vulnerabilities and other bugs which were corrected upstream.

Record
MGASA-2017-0446
Updated
2026-11-02
OSVopenSUSE-SU-2018:0470-1 No score

Security update for ffmpeg

This update for ffmpeg fixes the following issues:

Updated ffmpeg to new bugfix release 3.4.2

  • Fix integer overflows, multiplication overflows, undefined shifts, and verify buffer lengths.
  • avfilter/vf_transpose: Fix used plane count [boo#1078488, CVE-2018-6392]
  • avcodec/utvideodec: Fix bytes left check in decode_frame() [boo#1079368, CVE-2018-6621]
  • Enable use of libzvbi for displaying teletext subtitles.
  • Fixed a DoS in swri_audio_convert() [boo#1072366, CVE-2017-17555].

Update to new bugfix release 3.4.1

  • Fixed integer overflows, division by zero, illegal bit shifts
  • Fixed the gmc_mmx function which failed to validate width and height [boo#1070762, CVE-2017-17081]
  • Fixed out-of-bounds in VC-2 encoder [boo#1069407, CVE-2017-16840]
  • ffplay: use SDL2 audio API

  • install also doc/ffserver.conf

  • Update to new upstream release 3.4

    • New video filters: deflicker, doublewave, lumakey, pixscope, oscilloscope, robterts, limiter, libvmaf, unpremultiply, tlut2, floodifll, pseudocolor, despill, convolve, vmafmotion.
    • New audio filters: afir, crossfeed, surround, headphone, superequalizer, haas.
    • Some video filters with several inputs now use a common set of options: blend, libvmaf, lut3d, overlay, psnr, ssim. They must always be used by name.
    • librsvg support for svg rasterization
    • spec-compliant VP9 muxing support in MP4
    • Remove the libnut and libschroedinger muxer/demuxer wrappers
    • drop deprecated qtkit input device (use avfoundation instead)
    • SUP/PGS subtitle muxer
    • VP9 tile threading support
    • KMS screen grabber
    • CUDA thumbnail filter
    • V4L2 mem2mem HW assisted codecs
    • Rockchip MPP hardware decoding
    • (Not in openSUSE builds, only original ones:)
    • Gremlin Digital Video demuxer and decoder
    • Additional frame format support for Interplay MVE movies
    • Dolby E decoder and SMPTE 337M demuxer
    • raw G.726 muxer and demuxer, left- and right-justified
    • NewTek NDI input/output device
    • FITS demuxer, muxer, decoder and encoder

  • Fixed a double free in huffyuv [boo#1064577, CVE-2017-15186]

  • Fixed an out-of-bounds in ffv1dec [boo#1066428, CVE-2017-15672]

Record
openSUSE-SU-2018:0470-1
Updated
2026-11-02
OSVopenSUSE-SU-2018:0476-1 No score

Security update for ffmpeg

This update for ffmpeg fixes the following issues:

Updated ffmpeg to new bugfix release 3.4.2

  • Fix integer overflows, multiplication overflows, undefined shifts, and verify buffer lengths.
  • avfilter/vf_transpose: Fix used plane count [boo#1078488, CVE-2018-6392]
  • avcodec/utvideodec: Fix bytes left check in decode_frame() [boo#1079368, CVE-2018-6621]
  • Enable use of libzvbi for displaying teletext subtitles.
  • Fixed a DoS in swri_audio_convert() [boo#1072366, CVE-2017-17555].

Update to new bugfix release 3.4.1

  • Fixed integer overflows, division by zero, illegal bit shifts
  • Fixed the gmc_mmx function which failed to validate width and height [boo#1070762, CVE-2017-17081]
  • Fixed out-of-bounds in VC-2 encoder [boo#1069407, CVE-2017-16840]
  • ffplay: use SDL2 audio API

  • install also doc/ffserver.conf

  • Update to new upstream release 3.4

    • New video filters: deflicker, doublewave, lumakey, pixscope, oscilloscope, robterts, limiter, libvmaf, unpremultiply, tlut2, floodifll, pseudocolor, despill, convolve, vmafmotion.
    • New audio filters: afir, crossfeed, surround, headphone, superequalizer, haas.
    • Some video filters with several inputs now use a common set of options: blend, libvmaf, lut3d, overlay, psnr, ssim. They must always be used by name.
    • librsvg support for svg rasterization
    • spec-compliant VP9 muxing support in MP4
    • Remove the libnut and libschroedinger muxer/demuxer wrappers
    • drop deprecated qtkit input device (use avfoundation instead)
    • SUP/PGS subtitle muxer
    • VP9 tile threading support
    • KMS screen grabber
    • CUDA thumbnail filter
    • V4L2 mem2mem HW assisted codecs
    • Rockchip MPP hardware decoding
    • (Not in openSUSE builds, only original ones:)
    • Gremlin Digital Video demuxer and decoder
    • Additional frame format support for Interplay MVE movies
    • Dolby E decoder and SMPTE 337M demuxer
    • raw G.726 muxer and demuxer, left- and right-justified
    • NewTek NDI input/output device
    • FITS demuxer, muxer, decoder and encoder

  • Fixed a double free in huffyuv [boo#1064577, CVE-2017-15186]

  • Fixed an out-of-bounds in ffv1dec [boo#1066428, CVE-2017-15672]

Record
openSUSE-SU-2018:0476-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10754-1 No score

ffmpeg-4-4.4-5.2 on GA media

These are all security issues fixed in the ffmpeg-4-4.4-5.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10754-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ffmpeg
Alpine:v3.4
 before 3.1.11-r1
3.1.11-r1
ffmpeg
Alpine:v3.5
 before 3.1.11-r1
3.1.11-r1
ffmpeg
Alpine:v3.6
 before 3.2.9-r0
3.2.9-r0
ffmpeg
Debian:12
 before 7:3.4-1
7:3.4-1
ffmpeg
Debian:13
 before 7:3.4-1
7:3.4-1
ffmpeg
Debian:14
 before 7:3.4-1
7:3.4-1
ffmpeg
Debian:9
 before 7:3.2.9-1~deb9u1, plus listed versions
7:3.2.5-17:3.2.6-17:3.2.7-1~deb9u17:3.2.8-1~deb9u1
7:3.2.9-1~deb9u1
ffmpeg
Mageia:6
 before 3.3.5-1.mga6
3.3.5-1.mga6
ffmpeg
Mageia:6
 before 3.3.5-1.mga6.tainted
3.3.5-1.mga6.tainted
ffmpeg
SUSE:Package Hub 12 SP2
 before 3.4.2-14.1
3.4.2-14.1
ffmpeg-4
openSUSE:Tumbleweed
 before 4.4-5.2
4.4-5.2

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-15186 is a medium vulnerability (CVSS 6.5) in Ffmpeg, published October 24, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.65%, the 76th percentile. Fixed in ffmpeg 3.1.11-r1.

References

Show 59 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open