CVE-2016-8676: Null Pointer Dereference
Published Feb 15, 2017
·Updated
The getvlc2 function in getbits.h in Libav 11.9 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted mp3 file. NOTE: this issue exists due to an incomplete fix for CVE-2016-8675.
Affected Software
1 affected component
Libav Libav<=11.8
Remediation
Event History
Feb 15, 2017
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Data Sourced
via NVD·09:59 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2016-8676?
CVE-2016-8676 is rated as a high severity vulnerability due to its potential to cause a denial of service.
2
How do I fix CVE-2016-8676?
To fix CVE-2016-8676, upgrade Libav to version 11.9 or later.
3
What impact does CVE-2016-8676 have on systems?
CVE-2016-8676 can lead to a denial of service by causing a NULL pointer dereference and crashing the application.
4
Who is affected by CVE-2016-8676?
CVE-2016-8676 affects users of Libav versions prior to 11.9 that process crafted mp3 files.
5
Is CVE-2016-8676 related to any other vulnerabilities?
Yes, CVE-2016-8676 is an incomplete fix for CVE-2016-8675 and shares a similar impact.