PT-2017-14697 · FFmpeg · Ffmpeg

Insu Yun · Publicado 2017-11-30 · Atualizado 2024-06-15 · CVE-2017-17081

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions FFmpeg versions 2.3 through 3.4

Description The issue is related to the gmc mmx function in libavcodec/x86/mpegvideodsp.c, which does not properly validate widths and heights. This allows remote attackers to cause a denial of service via a crafted MPEG file, resulting in an integer signedness error and out-of-array read.

Recommendations For FFmpeg versions 2.3 through 3.4, consider updating to a version where this issue is fixed, as the current version does not properly handle the validation of widths and heights in the gmc mmx function.

Correção

DoS

Out of bounds Read

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

CVE-2017-17081

DSA-4099-1

MGASA-2018-0008

MGASA-2018-0116

OPENSUSE-SU-2018:0470-1

OPENSUSE-SU-2018:0476-1

OPENSUSE-SU-2024:10754-1

Produtos afetados

Ffmpeg

Referências · 82

• https://github.com/FFmpeg/FFmpeg/commit/27f8d386829689c346ff0cef00d3af57b9fb8903 · Nota
• https://github.com/FFmpeg/FFmpeg/commit/58cf31cee7a456057f337b3102a03206d833d5e8 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2017-17081 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2017-14054 · Nota
• https://cve.org/CVERecord?id=CVE-2017-17081 · Nota de Segurança
• https://suse.com/security/cve/CVE-2017-7863 · Nota
• https://suse.com/security/cve/CVE-2017-15186 · Nota
• https://suse.com/security/cve/CVE-2017-14171 · Nota
• https://bugzilla.suse.com/1064577 · Nota
• https://suse.com/security/cve/CVE-2017-14059 · Nota
• https://suse.com/security/cve/CVE-2017-7866 · Nota
• https://osv.dev/vulnerability/MGASA-2018-0008 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2017-7859 · Nota
• https://suse.com/security/cve/CVE-2017-14223 · Nota
• https://suse.com/security/cve/CVE-2016-10190 · Nota