PT-2017-14697 · FFmpeg · Ffmpeg

Insu Yun · Published 2017-11-30 · Updated 2024-06-15 · CVE-2017-17081

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions FFmpeg versions 2.3 through 3.4

Description The issue is related to the gmc mmx function in libavcodec/x86/mpegvideodsp.c, which does not properly validate widths and heights. This allows remote attackers to cause a denial of service via a crafted MPEG file, resulting in an integer signedness error and out-of-array read.

Recommendations For FFmpeg versions 2.3 through 3.4, consider updating to a version where this issue is fixed, as the current version does not properly handle the validation of widths and heights in the gmc mmx function.

Fix

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2017-17081

DSA-4099-1

MGASA-2018-0008

MGASA-2018-0116

OPENSUSE-SU-2018:0470-1

OPENSUSE-SU-2018:0476-1

OPENSUSE-SU-2024:10754-1

Affected Products

Ffmpeg

References · 82

• https://github.com/FFmpeg/FFmpeg/commit/58cf31cee7a456057f337b3102a03206d833d5e8 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-17081 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-17081 · Security Note
• https://osv.dev/vulnerability/MGASA-2018-0008 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2018-0116 · Vendor Advisory
• https://lists.ffmpeg.org/pipermail/ffmpeg-devel/2017-November/219748.html · Patch
• https://ubuntu.com/security/CVE-2017-17081 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10754-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-4099-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2018:0476-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4099-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0116.html · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17081 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-17081 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-17081 · Vendor Advisory