CVE-2017-7865

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

FFmpeg before 2017-01-24 has an out-of-bounds write caused by a heap-based buffer overflow related to the ipvideo_decode_block_opcode_0xA function in libavcodec/interplayvideo.c and the avcodec_align_dimensions2 function in libavcodec/utils.c.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/97685Third Party Advisory, VDB Entry
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=452Third Party Advisory, VDB Entry
https://github.com/FFmpeg/FFmpeg/commit/2080bc33717955a0e4268e738acf8c1eeddbf8cbPatch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/02/msg00005.htmlMailing List, Third Party Advisory
http://www.securityfocus.com/bid/97685Third Party Advisory, VDB Entry
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=452Third Party Advisory, VDB Entry
https://github.com/FFmpeg/FFmpeg/commit/2080bc33717955a0e4268e738acf8c1eeddbf8cbPatch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/02/msg00005.htmlMailing List, Third Party Advisory

Timeline

Published: Apr 14, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-78669.8FFmpeg before 2017-01-23 has an out-of-bounds write caused by a stack-based buffer overflow related to the decode_zbuf function in libavcode CVE-2017-78677.5International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow rel CVE-2017-78687.5International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow rel CVE-2017-78697.5GnuTLS before 2017-02-20 has an out-of-bounds write caused by an integer overflow and heap-based buffer overflow related to the cdk_pkt_read CVE-2017-78709.8LibreOffice before 2017-01-02 has an out-of-bounds write caused by a heap-based buffer overflow related to the tools::Polygon::Insert functi CVE-2017-78716.1trollepierre/tdm before 2017-04-13 is vulnerable to a reflected XSS in tdm-master/webhook.php (challenge parameter).CVE-2017-78759.8In wallpaper.c in feh before v2.18.3, if a malicious client pretends to be the E17 window manager, it is possible to trigger an out-of-bound CVE-2017-787610.0This command injection vulnerability in QTS allows attackers to run arbitrary commands in the compromised application. QNAP have already fix CVE-2017-78778.8CSRF vulnerability in flatCore version 1.4.6 allows remote attackers to modify CMS configurations.CVE-2017-78789.8SQL Injection vulnerability in flatCore version 1.4.6 allows an attacker to read and write to the users database.CVE-2017-78797.5SQL Injection vulnerability in flatCore version 1.4.6 allows an attacker to read the content database.CVE-2017-78818.8BigTree CMS through 4.2.17 relies on a substring check for CSRF protection, which allows remote attackers to bypass this check by placing th