Candidate: CVE-2016-10191
PublicDate: 2017-02-09 15:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10191
 http://www.openwall.com/lists/oss-security/2017/01/31/12
Description:
 Heap-based buffer overflow in libavformat/rtmppkt.c in FFmpeg before
 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2
 allows remote attackers to execute arbitrary code by leveraging failure to
 check for RTMP packet size mismatches.
Ubuntu-Description:
Notes:
 ebarretto> as of 2018-09-28, no equivalent fix for libav
Bugs:
Priority: medium
Discovered-by: Emil Lerner and Pavel Cheremushkin
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H [9.8 CRITICAL]

Patches_libav:
upstream_libav: needs-triage
precise_libav: ignored (reached end-of-life)
precise/esm_libav: DNE (precise was needs-triage)
trusty_libav: ignored
trusty/esm_libav: DNE (trusty was ignored)
vivid/stable-phone-overlay_libav: DNE
vivid/ubuntu-core_libav: DNE
xenial_libav: DNE
yakkety_libav: DNE
zesty_libav: DNE
artful_libav: DNE
bionic_libav: DNE
devel_libav: DNE

Patches_ffmpeg:
 upstream: https://github.com/FFmpeg/FFmpeg/commit/7d57ca4d9a75562fa32e40766211de150f8b3ee7
upstream_ffmpeg: released (7:3.2.2-1)
precise_ffmpeg: DNE
precise/esm_ffmpeg: DNE
trusty_ffmpeg: DNE
trusty/esm_ffmpeg: DNE
vivid/stable-phone-overlay_ffmpeg: DNE
vivid/ubuntu-core_ffmpeg: DNE
xenial_ffmpeg: released (7:2.8.11-0ubuntu0.16.04.1)
yakkety_ffmpeg: ignored (reached end-of-life)
zesty_ffmpeg: not-affected (7:3.2.2-2)
artful_ffmpeg: not-affected (7:3.2.2-2)
bionic_ffmpeg: not-affected (7:3.2.2-2)
devel_ffmpeg: not-affected (7:3.2.2-2)