CVE-2016-5199
HighSummary
An off by one error in FFmpeg in Google Chrome prior to version 54.0.2840.98 for Mac, 54.0.2840.99 for Windows, 54.0.2840.100 for Linux, and 55.0.2883.84 for Android may lead to an allocation of zero size. This allows a remote attacker to potentially exploit heap corruption via a crafted video file.
Risk Assessment
The organization may be exposed to remote attacks that could lead to memory corruption and potential takeover of the user's system.
Recommendation
It is recommended to update Google Chrome to the latest version to mitigate the risks associated with this vulnerability.
Other vulnerabilities in FFmpeg w Google Chrome
See all- CVE-2017-5050High
An integer overflow in FFmpeg in Google Chrome prior to version 57.0.2987.98 for Mac, Windows, and Linux and prior to version 57.0.2987.108 for Android allowed a remote attacker to perform an out of bounds memory write via a crafted video file, related to ChunkDemuxer.
- CVE-2017-5047High
An integer overflow in FFmpeg in Google Chrome prior to version 57.0.2987.98 for Mac, Windows, and Linux and prior to version 57.0.2987.108 for Android allowed a remote attacker to perform an out of bounds memory write via a crafted video file, related to ChunkDemuxer.
Original NVD description (English source)
An off by one error resulting in an allocation of zero size in FFmpeg in Google Chrome prior to 54.0.2840.98 for Mac, and 54.0.2840.99 for Windows, and 54.0.2840.100 for Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted video file.