Every CVE Search/ Get API key

CVE-2017-15672

The read_header function in libavcodec/ffv1dec.c in FFmpeg 2.4 and 3.3.4 and possibly earlier...

8.8 HighFix available

The read_header function in libavcodec/ffv1dec.c in FFmpeg 2.4 and 3.3.4 and possibly earlier allows remote attackers to have unspecified impact via a crafted MP4 file, which triggers an out-of-bounds read.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

2.00%Up 0.2 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 8.8

The read_header function in libavcodec/ffv1dec.c in FFmpeg 2.4 and 3.3.4 and possibly earlier allows remote attackers to have unspecified impact via a crafted MP4 file, which triggers an out-of-bounds read.

Record
CVE-2017-15672
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-125
Updated
2026-11-02
CVE List No score

The read_header function in libavcodec/ffv1dec.c in FFmpeg 2.4 and 3.3.4 and possibly earlier allows remote attackers to have unspecified impact via a crafted MP4 file, which triggers an out-of-bounds read.

Record
CVE-2017-15672
Updated
2026-11-02
EUVDEUVD-2017-7123 No score

The read_header function in libavcodec/ffv1dec.c in FFmpeg 2.4 and 3.3.4 and possibly earlier allows remote attackers to have unspecified impact via a crafted MP4 file, which triggers an out-of-bounds read.

Record
EUVD-2017-7123
Updated
2026-11-03
GitHub AdvisoriesGHSA-6f6x-vfc5-5gwm 8.8

The read_header function in libavcodec/ffv1dec.c in FFmpeg 2.4 and 3.3.4 and possibly earlier...

The read_header function in libavcodec/ffv1dec.c in FFmpeg 2.4 and 3.3.4 and possibly earlier allows remote attackers to have unspecified impact via a crafted MP4 file, which triggers an out-of-bounds read.

Record
GHSA-6f6x-vfc5-5gwm
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-125
Updated
2026-11-02
OSV 8.8

The read_header function in libavcodec/ffv1dec.c in FFmpeg 2.4 and 3.3.4 and possibly earlier allows remote attackers to have unspecified impact via a crafted MP4 file, which triggers an out-of-bounds read.

Record
CVE-2017-15672
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2017-15672 8.8

The read_header function in libavcodec/ffv1dec.c in FFmpeg 2.4 and 3.3.4 and possibly earlier allows remote attackers to have unspecified impact via a crafted MP4 file, which triggers an out-of-bounds read.

Record
DEBIAN-CVE-2017-15672
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2017-15672 8.8

The read_header function in libavcodec/ffv1dec.c in FFmpeg 2.4 and 3.3.4 and possibly earlier allows remote attackers to have unspecified impact via a crafted MP4 file, which triggers an out-of-bounds read.

Record
UBUNTU-CVE-2017-15672
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2018:0470-1 No score

Security update for ffmpeg

This update for ffmpeg fixes the following issues:

Updated ffmpeg to new bugfix release 3.4.2

  • Fix integer overflows, multiplication overflows, undefined shifts, and verify buffer lengths.
  • avfilter/vf_transpose: Fix used plane count [boo#1078488, CVE-2018-6392]
  • avcodec/utvideodec: Fix bytes left check in decode_frame() [boo#1079368, CVE-2018-6621]
  • Enable use of libzvbi for displaying teletext subtitles.
  • Fixed a DoS in swri_audio_convert() [boo#1072366, CVE-2017-17555].

Update to new bugfix release 3.4.1

  • Fixed integer overflows, division by zero, illegal bit shifts
  • Fixed the gmc_mmx function which failed to validate width and height [boo#1070762, CVE-2017-17081]
  • Fixed out-of-bounds in VC-2 encoder [boo#1069407, CVE-2017-16840]
  • ffplay: use SDL2 audio API

  • install also doc/ffserver.conf

  • Update to new upstream release 3.4

    • New video filters: deflicker, doublewave, lumakey, pixscope, oscilloscope, robterts, limiter, libvmaf, unpremultiply, tlut2, floodifll, pseudocolor, despill, convolve, vmafmotion.
    • New audio filters: afir, crossfeed, surround, headphone, superequalizer, haas.
    • Some video filters with several inputs now use a common set of options: blend, libvmaf, lut3d, overlay, psnr, ssim. They must always be used by name.
    • librsvg support for svg rasterization
    • spec-compliant VP9 muxing support in MP4
    • Remove the libnut and libschroedinger muxer/demuxer wrappers
    • drop deprecated qtkit input device (use avfoundation instead)
    • SUP/PGS subtitle muxer
    • VP9 tile threading support
    • KMS screen grabber
    • CUDA thumbnail filter
    • V4L2 mem2mem HW assisted codecs
    • Rockchip MPP hardware decoding
    • (Not in openSUSE builds, only original ones:)
    • Gremlin Digital Video demuxer and decoder
    • Additional frame format support for Interplay MVE movies
    • Dolby E decoder and SMPTE 337M demuxer
    • raw G.726 muxer and demuxer, left- and right-justified
    • NewTek NDI input/output device
    • FITS demuxer, muxer, decoder and encoder

  • Fixed a double free in huffyuv [boo#1064577, CVE-2017-15186]

  • Fixed an out-of-bounds in ffv1dec [boo#1066428, CVE-2017-15672]

Record
openSUSE-SU-2018:0470-1
Updated
2026-11-02
OSVopenSUSE-SU-2018:0476-1 No score

Security update for ffmpeg

This update for ffmpeg fixes the following issues:

Updated ffmpeg to new bugfix release 3.4.2

  • Fix integer overflows, multiplication overflows, undefined shifts, and verify buffer lengths.
  • avfilter/vf_transpose: Fix used plane count [boo#1078488, CVE-2018-6392]
  • avcodec/utvideodec: Fix bytes left check in decode_frame() [boo#1079368, CVE-2018-6621]
  • Enable use of libzvbi for displaying teletext subtitles.
  • Fixed a DoS in swri_audio_convert() [boo#1072366, CVE-2017-17555].

Update to new bugfix release 3.4.1

  • Fixed integer overflows, division by zero, illegal bit shifts
  • Fixed the gmc_mmx function which failed to validate width and height [boo#1070762, CVE-2017-17081]
  • Fixed out-of-bounds in VC-2 encoder [boo#1069407, CVE-2017-16840]
  • ffplay: use SDL2 audio API

  • install also doc/ffserver.conf

  • Update to new upstream release 3.4

    • New video filters: deflicker, doublewave, lumakey, pixscope, oscilloscope, robterts, limiter, libvmaf, unpremultiply, tlut2, floodifll, pseudocolor, despill, convolve, vmafmotion.
    • New audio filters: afir, crossfeed, surround, headphone, superequalizer, haas.
    • Some video filters with several inputs now use a common set of options: blend, libvmaf, lut3d, overlay, psnr, ssim. They must always be used by name.
    • librsvg support for svg rasterization
    • spec-compliant VP9 muxing support in MP4
    • Remove the libnut and libschroedinger muxer/demuxer wrappers
    • drop deprecated qtkit input device (use avfoundation instead)
    • SUP/PGS subtitle muxer
    • VP9 tile threading support
    • KMS screen grabber
    • CUDA thumbnail filter
    • V4L2 mem2mem HW assisted codecs
    • Rockchip MPP hardware decoding
    • (Not in openSUSE builds, only original ones:)
    • Gremlin Digital Video demuxer and decoder
    • Additional frame format support for Interplay MVE movies
    • Dolby E decoder and SMPTE 337M demuxer
    • raw G.726 muxer and demuxer, left- and right-justified
    • NewTek NDI input/output device
    • FITS demuxer, muxer, decoder and encoder

  • Fixed a double free in huffyuv [boo#1064577, CVE-2017-15186]

  • Fixed an out-of-bounds in ffv1dec [boo#1066428, CVE-2017-15672]

Record
openSUSE-SU-2018:0476-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10754-1 No score

ffmpeg-4-4.4-5.2 on GA media

These are all security issues fixed in the ffmpeg-4-4.4-5.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10754-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ffmpeg
Debian:12
 before 7:3.4-1
7:3.4-1
ffmpeg
Debian:13
 before 7:3.4-1
7:3.4-1
ffmpeg
Debian:14
 before 7:3.4-1
7:3.4-1
libav
Debian:8
 before 6:11.12-1~deb8u4, plus listed versions
6:11.11-1~deb8u16:11.12-1~deb8u16:11.12-1~deb8u26:11.12-1~deb8u36:11.3-1
Show 11 moreShow less
6:11.3-1+deb8u16:11.3-26:11.3-36:11.4-16:11.4-1~deb8u16:11.4-26:11.4-2+x32.16:11.6-1~deb8u16:11.7-1~deb8u16:11.8-1~deb8u16:11.9-1~deb8u1
6:11.12-1~deb8u4
ffmpeg
Debian:9
 before 7:3.2.9-1~deb9u1, plus listed versions
7:3.2.5-17:3.2.6-17:3.2.7-1~deb9u17:3.2.8-1~deb9u1
7:3.2.9-1~deb9u1
libav
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
6:0.8.7-1ubuntu26:9.10-1ubuntu16:9.10-1ubuntu26:9.10-1ubuntu56:9.10-1ubuntu6
Show 9 moreShow less
6:9.10-1ubuntu76:9.11-2ubuntu16:9.11-2ubuntu26:9.13-0ubuntu0.14.04.16:9.14-0ubuntu0.14.04.16:9.16-0ubuntu0.14.04.16:9.18-0ubuntu0.14.04.16:9.20-0ubuntu0.14.04.16:9.20-0ubuntu0.14.04.1+esm1
 None known
ffmpeg
Ubuntu:16.04:LTS
 before 7:2.8.14-0ubuntu0.16.04.1, plus listed versions
7:2.7.2-1build17:2.8.1-1ubuntu17:2.8.2-1ubuntu17:2.8.3-17:2.8.4-1
Show 9 moreShow less
7:2.8.4-1ubuntu17:2.8.4-1ubuntu27:2.8.4-1ubuntu37:2.8.4-1ubuntu47:2.8.6-1ubuntu17:2.8.6-1ubuntu27:2.8.8-0ubuntu0.16.04.17:2.8.10-0ubuntu0.16.04.17:2.8.11-0ubuntu0.16.04.1
7:2.8.14-0ubuntu0.16.04.1
ffmpeg
SUSE:Package Hub 12 SP2
 before 3.4.2-14.1
3.4.2-14.1
ffmpeg-4
openSUSE:Tumbleweed
 before 4.4-5.2
4.4-5.2

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-15672 is a high vulnerability (CVSS 8.8) in Ffmpeg, published November 6, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.00%, the 80th percentile. Fixed in ffmpeg 7:3.4-1.

References

Show 59 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open