PT-2017-13659 · Bellard+1 · Libbpg+1

Leonzhao7 · Publicado 2017-09-25 · Atualizado 2019-03-15 · CVE-2017-14734

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libbpg version 0.9.7

Description The issue allows remote attackers to cause a denial of service, which can result in a heap-based buffer overflow and application crash, or possibly have other unspecified impacts. This is achieved through a crafted BPG file, specifically related to the hevc decode init1 function in the build msps function in libbpg.c.

Recommendations For libbpg version 0.9.7, consider avoiding the use of crafted BPG files until a patch is available. As a temporary workaround, restricting access to the build msps function in libbpg.c may help minimize the risk of exploitation.

Exploit

Correção

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

ALT-PU-2019-1439

CVE-2017-14734

Produtos afetados

Alt Linux

Libbpg

Referências · 3

• 🔥 https://github.com/leonzhao7/vulnerability/blob/master/A%20heap-buffer-overflow%20vulnerability%20in%20hevc_decode_init1%20of%20libbpg.md · Exploit
• https://osv.dev/vulnerability/CVE-2017-14734 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-14734 · Nota de Segurança