PT-2017-13659 · Bellard+1 · Libbpg+1

Leonzhao7 · Published 2017-09-25 · Updated 2019-03-15 · CVE-2017-14734

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libbpg version 0.9.7

Description The issue allows remote attackers to cause a denial of service, which can result in a heap-based buffer overflow and application crash, or possibly have other unspecified impacts. This is achieved through a crafted BPG file, specifically related to the hevc decode init1 function in the build msps function in libbpg.c.

Recommendations For libbpg version 0.9.7, consider avoiding the use of crafted BPG files until a patch is available. As a temporary workaround, restricting access to the build msps function in libbpg.c may help minimize the risk of exploitation.

Exploit

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2019-1439

CVE-2017-14734

Affected Products

Alt Linux

Libbpg

References · 3

• 🔥 https://github.com/leonzhao7/vulnerability/blob/master/A%20heap-buffer-overflow%20vulnerability%20in%20hevc_decode_init1%20of%20libbpg.md · Exploit
• https://osv.dev/vulnerability/CVE-2017-14734 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-14734 · Security Note