FFmpeg 'libavcodec/pngdec.c' Out of Bounds Denial of Service Vulnerability

Bugtraq ID:	71619
Class:	Boundary Condition Error
CVE:	CVE-2014-9317
Remote:	Yes
Local:	No
Published:	Dec 09 2014 12:00AM
Updated:	Jul 06 2016 01:43PM
Credit:	Mateusz "j00ru" Jurczyk, and Gynvael Coldwind
Vulnerable:	Gentoo Linux
Not Vulnerable:

FFmpeg 'libavcodec/pngdec.c' Out of Bounds Denial of Service Vulnerability

FFmpeg is prone to a denial-of-service vulnerability.

An attacker can exploit this issue to crash the affected application, denying service to legitimate users. Due to the nature of this issue, code-execution may be possible; however this has not been confirmed.

The following versions are vulnerable:

Versions prior to FFmpeg 2.1.6
FFmpeg 2.2.x through 2.3.x
FFmpeg 2.4.x versions prior to 2.4.4

FFmpeg 'libavcodec/pngdec.c' Out of Bounds Denial of Service Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

FFmpeg 'libavcodec/pngdec.c' Out of Bounds Denial of Service Vulnerability

References:

• avcodec/pngdec: Check IHDR/IDAT order (FFmpeg)
  
• FFmpeg Homepage (FFmpeg)
  
• FFmpeg Security (FFmpeg)