CVE-2016-2399 Integer overflow in n/a
Remote attackers can cause denial of service or potential code execution via a crafted MP4 atom in libquicktime.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2016-2399?
CVE-2016-2399 is a high-severity vulnerability in n/a, published on 30 Jan 2017. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Integer overflow in the quicktime_read_pascal function in libquicktime 1.2.4 and earlier allows remote attackers to cause a denial of service or possibly have other unspecified impact via a crafted hdlr MP4 atom.
Weakness: CWE-190
Which versions are affected by CVE-2016-2399?
It affects 1 product.
Linux distribution packages (19)
libquicktime SUSE:Linux Enterprise Desktop 12 SP1 | All versions | 1.2.4-10.1 |
libquicktime SUSE:Linux Enterprise Desktop 12 SP2 | All versions | 1.2.4-10.1 |
libquicktime SUSE:Linux Enterprise Desktop 12 SP2 | All versions | 1.2.4-14.3.1 |
libquicktime SUSE:Linux Enterprise Desktop 12 SP3 | All versions | 1.2.4-14.3.1 |
libquicktime SUSE:Linux Enterprise Server 12 SP1 | All versions | 1.2.4-10.1 |
libquicktime SUSE:Linux Enterprise Server 12 SP2 | All versions | 1.2.4-10.1 |
libquicktime SUSE:Linux Enterprise Server 12 SP2 | All versions | 1.2.4-14.3.1 |
libquicktime SUSE:Linux Enterprise Server 12 SP3 | All versions | 1.2.4-14.3.1 |
libquicktime SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 | All versions | 1.2.4-10.1 |
libquicktime SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 | All versions | 1.2.4-14.3.1 |
libquicktime SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | All versions | 1.2.4-10.1 |
libquicktime SUSE:Linux Enterprise Server for SAP Applications 12 SP2 | All versions | 1.2.4-10.1 |
libquicktime SUSE:Linux Enterprise Server for SAP Applications 12 SP2 | All versions | 1.2.4-14.3.1 |
libquicktime SUSE:Linux Enterprise Server for SAP Applications 12 SP3 | All versions | 1.2.4-14.3.1 |
libquicktime SUSE:Linux Enterprise Software Development Kit 11 SP4 | All versions | 1.0.3-5.2 |
libquicktime SUSE:Linux Enterprise Software Development Kit 12 SP1 | All versions | 1.2.4-10.1 |
libquicktime SUSE:Linux Enterprise Software Development Kit 12 SP2 | All versions | 1.2.4-10.1 |
libquicktime SUSE:Linux Enterprise Software Development Kit 12 SP2 | All versions | 1.2.4-14.3.1 |
libquicktime SUSE:Linux Enterprise Software Development Kit 12 SP3 | All versions | 1.2.4-14.3.1 |
Products include Libquicktime Libquicktime.
How do I fix CVE-2016-2399?
Apply the vendor's patch.
Is CVE-2016-2399 being exploited?
There is no known exploitation of CVE-2016-2399 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2016-2399, DLA-844-1, DSA-3800-1, GHSA-fgmw-3v6x-mrm7, MGASA-2017-0084, SUSE-SU-2017:0610-1 and 3 more.