CVE-2017-15672

The read_header function in libavcodec/ffv1dec.c in FFmpeg 2.4 and 3.3.4 and possibly earlier allows remote attackers to have unspecified impact via a crafted MP4 file, which triggers an out-of-bounds read.

• CWE-125

• http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=c20f4fcb74da2d0432c7b54499bb98f48236b904
• http://www.openwall.com/lists/oss-security/2017/11/03/4Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/101690Third Party Advisory, VDB Entry
• https://github.com/FFmpeg/FFmpeg/commit/d893253fcd93d11258e98857175e93be7d158708
• https://lists.debian.org/debian-lts-announce/2019/01/msg00006.htmlMailing List, Third Party Advisory
• https://www.debian.org/security/2017/dsa-4049Third Party Advisory
• http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=c20f4fcb74da2d0432c7b54499bb98f48236b904
• http://www.openwall.com/lists/oss-security/2017/11/03/4Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/101690Third Party Advisory, VDB Entry
• https://github.com/FFmpeg/FFmpeg/commit/d893253fcd93d11258e98857175e93be7d158708
• https://lists.debian.org/debian-lts-announce/2019/01/msg00006.htmlMailing List, Third Party Advisory
• https://www.debian.org/security/2017/dsa-4049Third Party Advisory

Published

Nov 6, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-15664In Flexense Sync Breeze Enterprise v10.1.16, the Control Pro…
• CVE-2017-15665In Flexense DiskBoss Enterprise 8.5.12, the Control Protocol…
• CVE-2017-15667In Flexense SysGauge Server 3.6.18, the Control Protocol suf…
• CVE-2017-1567IBM Doors Web Access 9.5 and 9.6 is vulnerable to cross-site…
• CVE-2017-15670The GNU C Library (aka glibc or libc6) before 2.27 contains …
• CVE-2017-15671The glob function in glob.c in the GNU C Library (aka glibc …
• CVE-2017-15673The files function in the administration section in CS-Cart …
• CVE-2017-1568IBM Rational Quality Manager and IBM Rational Collaborative …5.4
• CVE-2017-15680In Crafter CMS Crafter Studio 3.0.1 an IDOR vulnerability ex…6.5
• CVE-2017-15681In Crafter CMS Crafter Studio 3.0.1 a directory traversal vu…9.8
• CVE-2017-15682In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attac…6.1
• CVE-2017-15683In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attac…8.6