Candidate: CVE-2016-10192
PublicDate: 2017-02-09 15:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10192
 http://www.openwall.com/lists/oss-security/2017/01/31/12
Description:
 Heap-based buffer overflow in ffserver.c in FFmpeg before 2.8.10, 3.0.x
 before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote
 attackers to execute arbitrary code by leveraging failure to check chunk
 size.
Ubuntu-Description:
Notes:
 ebarretto> as of 2018-09-28, no equivalent fix for libav
Bugs:
Priority: medium
Discovered-by: Emil Lerner and Pavel Cheremushkin
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H [9.8 CRITICAL]

Patches_libav:
upstream_libav: needed
precise_libav: ignored (reached end-of-life)
precise/esm_libav: DNE (precise was needed)
trusty_libav: ignored
trusty/esm_libav: DNE (trusty was ignored)
vivid/stable-phone-overlay_libav: DNE
vivid/ubuntu-core_libav: DNE
xenial_libav: DNE
yakkety_libav: DNE
zesty_libav: DNE
artful_libav: DNE
bionic_libav: DNE
devel_libav: DNE

Patches_ffmpeg:
 upstream: https://github.com/FFmpeg/FFmpeg/commit/c12ee64e80af2517005231388fdf4ea78f16bb0e
upstream_ffmpeg: released (7:3.2.2-1)
precise_ffmpeg: DNE
precise/esm_ffmpeg: DNE
trusty_ffmpeg: DNE
trusty/esm_ffmpeg: DNE
vivid/stable-phone-overlay_ffmpeg: DNE
vivid/ubuntu-core_ffmpeg: DNE
xenial_ffmpeg: released (7:2.8.11-0ubuntu0.16.04.1)
yakkety_ffmpeg: ignored (reached end-of-life)
zesty_ffmpeg: not-affected (7:3.2.2-2)
artful_ffmpeg: not-affected (7:3.2.2-2)
bionic_ffmpeg: not-affected (7:3.2.2-2)
devel_ffmpeg: not-affected (7:3.2.2-2)