PT-2016-3169 · FFmpeg+2 · Ffmpeg+2
Wangchu
+1
·
Published
2016-08-25
·
Updated
2024-06-15
·
CVE-2017-14055
CVSS v2.0
7.1
High
| Vector | AV:N/AC:M/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
FFmpeg version 3.3.3
Description
The issue is related to a lack of an End of File (EOF) check in the
mv read header() function, which can cause huge CPU and memory consumption. This occurs when a crafted MV file with a large nb frames field in the header but insufficient backing data is provided, leading to a loop that consumes significant resources. The exploitation of this issue may allow a remote attacker to cause a denial of service by exhausting memory and CPU resources.Recommendations
For FFmpeg version 3.3.3, consider applying a patch or updating to a newer version that includes a fix for the
mv read header() function to add an EOF check, preventing excessive resource consumption. As a temporary workaround, consider restricting the use of the mv read header() function or limiting the processing of MV files with large nb frames fields to minimize the risk of exploitation.Exploit
Fix
DoS
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Ffmpeg
Suse