PT-2017-14587 · FFmpeg · Ffmpeg

Liu Bingchang · Published 2017-11-21 · Updated 2024-06-15 · CVE-2017-16840

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FFmpeg versions 3.0 through 3.4

Description The issue is related to the VC-2 Video Compression encoder, which allows remote attackers to cause a denial of service due to an out-of-bounds read. This occurs because of incorrect buffer padding for non-Haar wavelets, specifically in the files libavcodec/vc2enc.c and libavcodec/vc2enc dwt.c.

Recommendations For FFmpeg versions 3.0 through 3.4, consider updating to a version that addresses the incorrect buffer padding issue for non-Haar wavelets in the VC-2 Video Compression encoder. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2017-16840

DSA-4049-1

MGASA-2018-0116

OPENSUSE-SU-2018:0470-1

OPENSUSE-SU-2018:0476-1

OPENSUSE-SU-2024:10754-1

Affected Products

Ffmpeg

References · 81

• https://github.com/FFmpeg/FFmpeg/commit/94e538aebbc9f9c529e8b1f2eda860cfb8c473b1 · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15672 · Security Note
• https://security-tracker.debian.org/tracker/DSA-4049-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-16840 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15186 · Security Note
• https://debian.org/security/2017/dsa-4049 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-16840 · Security Note
• https://osv.dev/vulnerability/MGASA-2018-0116 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-16840 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10754-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2018:0476-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0116.html · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-16840 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-16840 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-16840 · Vendor Advisory