GCVE - cpe:2.3:a:ffmpeg:ffmpeg:3.3:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:ffmpeg:ffmpeg:3.3:*:*:*:*:*:*:*

part: a version: 3.3 update: *

Vendor	Ffmpeg (`4a8454a9-7e7a-5dff-9bf8-e8d1aa1a4a2f`)
Product	Ffmpeg (`69475a2d-e046-5b0f-b6da-299c42a85e87`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/ffmpeg`	purl2cpe	2026-06-01 10:12:29.448533
`pkg:deb/ubuntu/ffmpeg`	purl2cpe	2026-06-01 10:12:29.448534
`pkg:ffmpeg/ffmpeg`	purl2cpe	2026-06-01 10:12:29.448536
`pkg:github/ffmpeg/ffmpeg`	purl2cpe	2026-06-01 10:12:29.448537
`pkg:opensuse/ffmpeg`	purl2cpe	2026-06-01 10:12:29.448538

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-9996`	vulnerable	2026-06-08 05:10:20.230400	Details available The cdxl_decode_frame function in libavcodec/cdxl.c in FFmpeg 2.8.x before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 does not exclude the CHUNKY format, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file. Published: 2017-06-28T06:00:00.000Z Updated: 2024-08-05T17:25:00.874Z Open on db.gcve.eu Reference links https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1378 http://www.securityfocus.com/bid/99323 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1427 https://github.com/FFmpeg/FFmpeg/commit/1e42736b95065c69a7481d0cf55247024f54b660 https://github.com/FFmpeg/FFmpeg/commit/e1b60aad77c27ed5d4dfc11e5e6a05a38c70489d	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-9995`	vulnerable	2026-06-08 05:10:20.220685	Details available libavcodec/scpr.c in FFmpeg 3.3 before 3.3.1 does not properly validate height and width data, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file. Published: 2017-06-28T06:00:00.000Z Updated: 2024-08-05T17:25:00.536Z Open on db.gcve.eu Reference links https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1519 https://github.com/FFmpeg/FFmpeg/commit/2171dfae8c065878a2e130390eb78cf2947a5b69 http://www.securityfocus.com/bid/99320 https://github.com/FFmpeg/FFmpeg/commit/7ac5067146613997bb38442cb022d7f41321a706 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1478	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-9991`	vulnerable	2026-06-08 05:10:20.218414	Details available Heap-based buffer overflow in the xwd_decode_frame function in libavcodec/xwddec.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file. Published: 2017-06-28T06:00:00.000Z Updated: 2024-08-05T17:25:00.371Z Open on db.gcve.eu Reference links https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1399 http://www.securityfocus.com/bid/99316 https://github.com/FFmpeg/FFmpeg/commit/441026fcb13ac23aa10edc312bdacb6445a0ad06	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.