PT-2017-2972 · FFmpeg+2 · Ffmpeg+2
Wangchu
+1
·
Publicado
2017-09-05
·
Atualizado
2024-06-15
·
CVE-2017-14223
CVSS v2.0
7.1
Alta
| Vetor | AV:N/AC:M/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
FFmpeg version 3.3.3
Description
The issue is related to a lack of an End of File (EOF) check in the asf build simple index() function, which can cause huge CPU consumption. This occurs when a crafted ASF file with a large "ict" field in the header but insufficient backing data is processed, leading to a loop that consumes significant CPU and memory resources.
Recommendations
For FFmpeg version 3.3.3, consider applying a patch or fix that adds an EOF check to the asf build simple index() function to prevent excessive CPU consumption. As a temporary workaround, consider restricting the processing of ASF files with large "ict" fields in the header to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
DoS
Resource Exhaustion
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Ffmpeg
Suse