CVE-2016-3062

The mov_read_dref function in libavformat/mov.c in Libav before 11.7 and FFmpeg before 0.11 allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via the entries value in a dref box in an MP4 file.

• CWE-119

• http://lists.opensuse.org/opensuse-updates/2016-06/msg00105.htmlThird Party Advisory
• http://www.debian.org/security/2016/dsa-3603Third Party Advisory
• https://bugzilla.libav.org/show_bug.cgi?id=929Issue Tracking, Vendor Advisory
• https://ffmpeg.org/security.html
• https://git.libav.org/?p=libav.git%3Ba=commit%3Bh=7e01d48cfd168c3dfc663f03a3b6a98e0ecba328
• https://github.com/FFmpeg/FFmpeg/commit/689e59b7ffed34eba6159dcc78e87133862e3746Patch
• https://libav.org/releases/libav-11.7.changelogRelease Notes
• https://security.gentoo.org/glsa/201705-08
• http://lists.opensuse.org/opensuse-updates/2016-06/msg00105.htmlThird Party Advisory
• http://www.debian.org/security/2016/dsa-3603Third Party Advisory
• https://bugzilla.libav.org/show_bug.cgi?id=929Issue Tracking, Vendor Advisory
• https://ffmpeg.org/security.html
• https://git.libav.org/?p=libav.git%3Ba=commit%3Bh=7e01d48cfd168c3dfc663f03a3b6a98e0ecba328
• https://github.com/FFmpeg/FFmpeg/commit/689e59b7ffed34eba6159dcc78e87133862e3746Patch
• https://libav.org/releases/libav-11.7.changelogRelease Notes
• https://security.gentoo.org/glsa/201705-08

Published

Jun 16, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-3054Cross-site scripting (XSS) vulnerability in IBM FileNet Work…
• CVE-2016-3055IBM FileNet Workplace 4.0.2 before 4.0.2.14 LA012 allows rem…
• CVE-2016-3056Cross-site scripting (XSS) vulnerability in Business Space i…
• CVE-2016-3057Cross-site scripting (XSS) vulnerability in IBM Sterling B2B…
• CVE-2016-3059IBM Tivoli Storage Manager for Databases: Data Protection fo…
• CVE-2016-3060Payments Director in IBM Financial Transaction Manager (FTM)…
• CVE-2016-3063Multiple functions in NetApp OnCommand System Manager before…
• CVE-2016-3064NetApp Clustered Data ONTAP before 8.2.4P4 and 8.3.x before …
• CVE-2016-3065The (1) brin_page_type and (2) brin_metapage_info functions …
• CVE-2016-3066The spice-gtk widget allows remote authenticated users to ob…
• CVE-2016-3067Cygwin before 2.5.0 does not properly handle updating permis…
• CVE-2016-3068Mercurial before 3.7.3 allows remote attackers to execute ar…