Bug 1361977 (CVE-2016-2839)

Summary:	CVE-2016-2839 Mozilla: Cairo rendering crash due to memory allocation issue with FFMpeg 0.10 (MFSA 2016-65)
Product:	[Other] Security Response	Reporter:	Huzaifa S. Sidhpurwala <huzaifas>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	jhorak, security-response-team, stransky
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-09-23 05:31:13 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1360577

Description Huzaifa S. Sidhpurwala 2016-08-01 06:19:31 UTC

Security researcher Bert Massop reported a crash in the Cairo graphics layer on Linux systems using the LibAV library included in version 0.10 of the FFmpeg library. This was due to a size when allocating the LibAV header when decoding some videos.

This only affects systems running the Linux operating system that also have FFMpeg version 0.10 installed and does not affect OS X or Windows systems.



External Reference:

https://www.mozilla.org/security/announce/2016/mfsa2016-65.html


Acknowledgements:

Name: the Mozilla project
Upstream: Bert Massop