CVE-2017-11399

Upstream information

CVE-2017-11399 at MITRE

Description

Integer overflow in the ape_decode_frame function in libavcodec/apedec.c in FFmpeg 2.4 through 3.3.2 allows remote attackers to cause a denial of service (out-of-array access and application crash) or possibly have unspecified other impact via a crafted APE file.

---

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having moderate severity.

CVSS v2 Scores

	National Vulnerability Database
Base Score	6.8
Vector	AV:N/AC:M/Au:N/C:P/I:P/A:P
Access Vector	Network
Access Complexity	Medium
Authentication	None
Confidentiality Impact	Partial
Integrity Impact	Partial
Availability Impact	Partial

CVSS v3 Scores

	National Vulnerability Database
Base Score	7.8
Vector	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Access Vector	Local
Access Complexity	Low
Privileges Required	None
User Interaction	Required
Scope	Unchanged
Confidentiality Impact	High
Integrity Impact	High
Availability Impact	High
CVSSv3 Version	3

SUSE Bugzilla entry: 1049095 [RESOLVED / FIXED]

SUSE Security Advisories:

• openSUSE-SU-2017:2501-1, published Sat, 16 Sep 2017 00:09:50 +0200 (CEST)
• openSUSE-SU-2017:2502-1, published Sat, 16 Sep 2017 00:12:39 +0200 (CEST)

List of released packages

Product(s)	Fixed package version(s)	References
SUSE Linux Enterprise Desktop 15 SP1 SUSE Linux Enterprise Server 15 SP1 SUSE Linux Enterprise Server for SAP Applications 15 SP1	libavcodec-devel >= 3.4.2-4.12.4 libavcodec57 >= 3.4.2-4.12.4 libavformat-devel >= 3.4.2-4.12.4 libavformat57 >= 3.4.2-4.12.4 libavresample-devel >= 3.4.2-4.12.4 libavresample3 >= 3.4.2-4.12.4 libavutil-devel >= 3.4.2-4.12.4 libavutil55 >= 3.4.2-4.12.4 libpostproc-devel >= 3.4.2-4.12.4 libpostproc54 >= 3.4.2-4.12.4 libswresample-devel >= 3.4.2-4.12.4 libswresample2 >= 3.4.2-4.12.4 libswscale-devel >= 3.4.2-4.12.4 libswscale4 >= 3.4.2-4.12.4	Patchnames: SUSE Linux Enterprise Module for Desktop Applications 15 SP1 GA libavcodec57-3.4.2-4.12.4 SUSE Linux Enterprise Workstation Extension 15 SP1 GA libavcodec-devel-3.4.2-4.12.4
SUSE Linux Enterprise Desktop 15 SP2 SUSE Linux Enterprise Server 15 SP2 SUSE Linux Enterprise Server for SAP Applications 15 SP2	libavcodec-devel >= 3.4.2-9.2 libavcodec57 >= 3.4.2-9.2 libavformat-devel >= 3.4.2-9.2 libavformat57 >= 3.4.2-9.2 libavresample-devel >= 3.4.2-9.2 libavresample3 >= 3.4.2-9.2 libavutil-devel >= 3.4.2-9.2 libavutil55 >= 3.4.2-9.2 libpostproc-devel >= 3.4.2-9.2 libpostproc54 >= 3.4.2-9.2 libswresample-devel >= 3.4.2-9.2 libswresample2 >= 3.4.2-9.2 libswscale-devel >= 3.4.2-9.2 libswscale4 >= 3.4.2-9.2	Patchnames: SUSE Linux Enterprise Module for Desktop Applications 15 SP2 GA libavcodec57-3.4.2-9.2 SUSE Linux Enterprise Workstation Extension 15 SP2 GA libavcodec-devel-3.4.2-9.2
SUSE Linux Enterprise Desktop 15 SP3 SUSE Linux Enterprise High Performance Computing 15 SP3 SUSE Linux Enterprise Module for Desktop Applications 15 SP3 SUSE Linux Enterprise Server 15 SP3 SUSE Linux Enterprise Server for SAP Applications 15 SP3 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2	libavcodec57 >= 3.4.2-9.2 libavformat57 >= 3.4.2-9.2 libavutil-devel >= 3.4.2-9.2 libavutil55 >= 3.4.2-9.2 libpostproc-devel >= 3.4.2-9.2 libpostproc54 >= 3.4.2-9.2 libswresample-devel >= 3.4.2-9.2 libswresample2 >= 3.4.2-9.2 libswscale-devel >= 3.4.2-9.2 libswscale4 >= 3.4.2-9.2	Patchnames: SUSE Linux Enterprise Module for Desktop Applications 15 SP3 GA libavcodec57-3.4.2-9.2
SUSE Linux Enterprise Desktop 15 SUSE Linux Enterprise Server 15 SUSE Linux Enterprise Server for SAP Applications 15	libavcodec-devel >= 3.4.2-2.35 libavcodec57 >= 3.4.2-2.35 libavformat-devel >= 3.4.2-2.35 libavformat57 >= 3.4.2-2.35 libavresample-devel >= 3.4.2-2.35 libavresample3 >= 3.4.2-2.35 libavutil-devel >= 3.4.2-2.35 libavutil55 >= 3.4.2-2.35 libpostproc-devel >= 3.4.2-2.35 libpostproc54 >= 3.4.2-2.35 libswresample-devel >= 3.4.2-2.35 libswresample2 >= 3.4.2-2.35 libswscale-devel >= 3.4.2-2.35 libswscale4 >= 3.4.2-2.35	Patchnames: SUSE Linux Enterprise Module for Desktop Applications 15 GA libavcodec57-3.4.2-2.35 SUSE Linux Enterprise Workstation Extension 15 GA libavcodec-devel-3.4.2-2.35
SUSE Linux Enterprise High Performance Computing 15 SP1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1 SUSE Linux Enterprise Storage 6 SUSE Manager Proxy 4.0 SUSE Manager Retail Branch Server 4.0 SUSE Manager Server 4.0	libavcodec57 >= 3.4.2-4.12.4 libavutil-devel >= 3.4.2-4.12.4 libavutil55 >= 3.4.2-4.12.4 libpostproc-devel >= 3.4.2-4.12.4 libpostproc54 >= 3.4.2-4.12.4 libswresample-devel >= 3.4.2-4.12.4 libswresample2 >= 3.4.2-4.12.4 libswscale-devel >= 3.4.2-4.12.4 libswscale4 >= 3.4.2-4.12.4	Patchnames: SUSE Linux Enterprise Module for Desktop Applications 15 SP1 GA libavcodec57-3.4.2-4.12.4
SUSE Linux Enterprise High Performance Computing 15 SP2 SUSE Linux Enterprise Module for Desktop Applications 15 SP2 SUSE Linux Enterprise Storage 7 SUSE Manager Proxy 4.1 SUSE Manager Retail Branch Server 4.1 SUSE Manager Server 4.1	libavcodec57 >= 3.4.2-9.2 libavformat57 >= 3.4.2-9.2 libavutil-devel >= 3.4.2-9.2 libavutil55 >= 3.4.2-9.2 libpostproc-devel >= 3.4.2-9.2 libpostproc54 >= 3.4.2-9.2 libswresample-devel >= 3.4.2-9.2 libswresample2 >= 3.4.2-9.2 libswscale-devel >= 3.4.2-9.2 libswscale4 >= 3.4.2-9.2	Patchnames: SUSE Linux Enterprise Module for Desktop Applications 15 SP2 GA libavcodec57-3.4.2-9.2
SUSE Linux Enterprise High Performance Computing 15 SUSE Linux Enterprise Module for Desktop Applications 15	libavcodec57 >= 3.4.2-2.35 libavutil-devel >= 3.4.2-2.35 libavutil55 >= 3.4.2-2.35 libpostproc-devel >= 3.4.2-2.35 libpostproc54 >= 3.4.2-2.35 libswresample-devel >= 3.4.2-2.35 libswresample2 >= 3.4.2-2.35 libswscale-devel >= 3.4.2-2.35 libswscale4 >= 3.4.2-2.35	Patchnames: SUSE Linux Enterprise Module for Desktop Applications 15 GA libavcodec57-3.4.2-2.35
SUSE Linux Enterprise Workstation Extension 15 SP1	libavcodec-devel >= 3.4.2-4.12.4 libavformat-devel >= 3.4.2-4.12.4 libavformat57 >= 3.4.2-4.12.4 libavresample-devel >= 3.4.2-4.12.4 libavresample3 >= 3.4.2-4.12.4	Patchnames: SUSE Linux Enterprise Workstation Extension 15 SP1 GA libavcodec-devel-3.4.2-4.12.4
SUSE Linux Enterprise Workstation Extension 15 SP2	libavcodec-devel >= 3.4.2-9.2 libavformat-devel >= 3.4.2-9.2 libavresample-devel >= 3.4.2-9.2 libavresample3 >= 3.4.2-9.2	Patchnames: SUSE Linux Enterprise Workstation Extension 15 SP2 GA libavcodec-devel-3.4.2-9.2
SUSE Linux Enterprise Workstation Extension 15	libavcodec-devel >= 3.4.2-2.35 libavformat-devel >= 3.4.2-2.35 libavformat57 >= 3.4.2-2.35 libavresample-devel >= 3.4.2-2.35 libavresample3 >= 3.4.2-2.35	Patchnames: SUSE Linux Enterprise Workstation Extension 15 GA libavcodec-devel-3.4.2-2.35
openSUSE Leap 15.0	libavcodec57 >= 3.4.2-lp150.2.1 libavdevice57 >= 3.4.2-lp150.2.1 libavfilter6 >= 3.4.2-lp150.2.1 libavformat57 >= 3.4.2-lp150.2.1 libavresample3 >= 3.4.2-lp150.2.1 libavutil55 >= 3.4.2-lp150.2.1 libpostproc54 >= 3.4.2-lp150.2.1 libswresample2 >= 3.4.2-lp150.2.1 libswscale4 >= 3.4.2-lp150.2.1	Patchnames: openSUSE Leap 15.0 GA libavcodec57-3.4.2-lp150.2.1
openSUSE Tumbleweed	ffmpeg-4 >= 4.4-5.2 ffmpeg-4-libavcodec-devel >= 4.4-5.2 ffmpeg-4-libavdevice-devel >= 4.4-5.2 ffmpeg-4-libavfilter-devel >= 4.4-5.2 ffmpeg-4-libavformat-devel >= 4.4-5.2 ffmpeg-4-libavresample-devel >= 4.4-5.2 ffmpeg-4-libavutil-devel >= 4.4-5.2 ffmpeg-4-libpostproc-devel >= 4.4-5.2 ffmpeg-4-libswresample-devel >= 4.4-5.2 ffmpeg-4-libswscale-devel >= 4.4-5.2 ffmpeg-4-private-devel >= 4.4-5.2 libavcodec58_134 >= 4.4-5.2 libavcodec58_134-32bit >= 4.4-5.2 libavdevice58_13 >= 4.4-5.2 libavdevice58_13-32bit >= 4.4-5.2 libavfilter7_110 >= 4.4-5.2 libavfilter7_110-32bit >= 4.4-5.2 libavformat58_76 >= 4.4-5.2 libavformat58_76-32bit >= 4.4-5.2 libavresample4_0 >= 4.4-5.2 libavresample4_0-32bit >= 4.4-5.2 libavutil56_70 >= 4.4-5.2 libavutil56_70-32bit >= 4.4-5.2 libpostproc55_9 >= 4.4-5.2 libpostproc55_9-32bit >= 4.4-5.2 libswresample3_9 >= 4.4-5.2 libswresample3_9-32bit >= 4.4-5.2 libswscale5_9 >= 4.4-5.2 libswscale5_9-32bit >= 4.4-5.2	Patchnames: openSUSE Tumbleweed GA ffmpeg-4-4.4-5.2