PT-2017-14587 · FFmpeg · Ffmpeg

Liu Bingchang

·

Publicado

2017-11-21

·

Atualizado

2024-06-15

·

CVE-2017-16840

CVSS v3.1

9.8

Crítica

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions FFmpeg versions 3.0 through 3.4
Description The issue is related to the VC-2 Video Compression encoder, which allows remote attackers to cause a denial of service due to an out-of-bounds read. This occurs because of incorrect buffer padding for non-Haar wavelets, specifically in the files libavcodec/vc2enc.c and libavcodec/vc2enc dwt.c.
Recommendations For FFmpeg versions 3.0 through 3.4, consider updating to a version that addresses the incorrect buffer padding issue for non-Haar wavelets in the VC-2 Video Compression encoder. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Out of bounds Read

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

CVE-2017-16840
DSA-4049-1
MGASA-2018-0116
OPENSUSE-SU-2018:0470-1
OPENSUSE-SU-2018:0476-1
OPENSUSE-SU-2024:10754-1

Produtos afetados

Ffmpeg