CVE-2017-9992: debian debian_linux
CVSS: 8.8v3.0HighModified
AliasesALPINE-CVE-2017-9992UBUNTU-CVE-2017-9992DEBIAN-CVE-2017-9992CGA-5qgp-pwqg-x3q9CGA-662m-8pw9-jg5rCGA-7h55-w4r7-rg7hCGA-7wmf-vrrp-hp73CGA-84f9-45x6-38mmCGA-fv7r-jvjf-w433CGA-mph8-q5m6-x5ppCGA-qp62-mx9v-263j
Published 28-06-2017Last modified 05-08-2024
Vulnerability summary
CVE-2017-9992 is a high (CVSS 8.8) vulnerability in debian debian_linux. EPSS estimates a 2.79% chance of exploitation in the next 30 days, higher than 86.2% of scored vulnerabilities.
CVSS score
8.8/10
010
High · v3.0 (NVD)EPSS score
2.79%
0%100%
Low · +0.02 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 3Timeline
- 28-06-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
Heap-based buffer overflow in the decode_dds1 function in libavcodec/dfa.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file.
CVSS metrics
6 scores · 5 sources · 2 versionsHigh 8.8Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSourcesAll 5 agree
- OSV · AlpineEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Medium 6.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
2.79%
Chance of exploitation in the next 30 days
Percentile
86%
Versus all other CVEs
30-day change
+0.02 pp
From 2.77% on 18-09-2026
18-09-202618-10-2026
EPSS score2.79%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard4 products
- torchaudio-ffmpeg-tarballsAll versions (No fix recorded)
- torchaudio-ffmpeg-tarballs-4.4.4All versions (No fix recorded)
- torchaudio-ffmpeg-tarballs-5.0.3All versions (No fix recorded)
- torchaudio-ffmpeg-tarballs-6.0All versions (No fix recorded)
Debian2 products
- ffmpeg< 7:3.2.5-1
- debian_linuxEOL8.0
Ubuntu2 products
- ffmpeg< 7:2.8.14-0ubuntu0.16.04.1
- libavAll versions (No fix recorded)
Alpine1 product
- ffmpeg≥ 3.0, < 3.1.8-r0 | ≥ 3.0, < 3.2.5-r0
Ffmpeg1 product
- ffmpeg< 2.8.12 | ≥ 3.0, < 3.0.8 | ≥ 3.1, < 3.1.8 | ≥ 3.2, < 3.2.5 | ≥ 3.3, < 3.3.1
5 vendors · 10 products
References
8 links- github.com/FFmpeg/FFmpeg/commit/f52fbf4f3ed02a7d872d8a102006f29b4421f360X Refsource MISCIssue TrackingPatchThird Party AdvisoryREPORTFIX
- bugs.chromium.org/p/oss-fuzz/issues/detail?id=1345X Refsource MISCIssue TrackingThird Party AdvisoryREPORT
