Double-free vulnerability in libavformat/mov.c in FFMPEG in Google Chrome 41.0.2251.0 allows remote attackers to cause a denial of service (memory corruption and crash) via a crafted .m4a file.
Weakness
The product calls free() twice on the same memory address.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Chrome | 41.0.2251.0 (including) | 41.0.2251.0 (including) | |
| Chromium-browser | Ubuntu | yakkety | * |
| Ffmpeg | Ubuntu | artful | * |
| Ffmpeg | Ubuntu | yakkety | * |
| Ffmpeg | Ubuntu | zesty | * |
| Oxide-qt | Ubuntu | artful | * |
| Oxide-qt | Ubuntu | esm-infra/xenial | * |
| Oxide-qt | Ubuntu | trusty | * |
| Oxide-qt | Ubuntu | vivid/stable-phone-overlay | * |
| Oxide-qt | Ubuntu | xenial | * |
| Oxide-qt | Ubuntu | yakkety | * |
| Oxide-qt | Ubuntu | zesty | * |
Potential Mitigations
References
- https://bugs.chromium.org/p/chromium/issues/detail?id=444539
- https://gist.github.com/bittorrent3389/8fee7cdaa73d1d351ee9
- https://lists.debian.org/debian-lts-announce/2019/02/msg00005.html
- https://bugs.chromium.org/p/chromium/issues/detail?id=444539
- https://gist.github.com/bittorrent3389/8fee7cdaa73d1d351ee9
- https://lists.debian.org/debian-lts-announce/2019/02/msg00005.html