CVE-2017-17081

Опубликовано: 30 нояб. 2017

Источник: nvd

CVSS3: 6.5

CVSS2: 4.3

EPSS Низкий

Описание

The gmc_mmx function in libavcodec/x86/mpegvideodsp.c in FFmpeg 2.3 and 3.4 does not properly validate widths and heights, which allows remote attackers to cause a denial of service (integer signedness error and out-of-array read) via a crafted MPEG file.

Ссылки

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3516#c1
Issue Tracking
https://github.com/FFmpeg/FFmpeg/commit/27f8d386829689c346ff0cef00d3af57b9fb8903
https://github.com/FFmpeg/FFmpeg/commit/58cf31cee7a456057f337b3102a03206d833d5e8
Patch
Vendor Advisory
https://lists.ffmpeg.org/pipermail/ffmpeg-devel/2017-November/219748.html
Issue Tracking
Patch
https://www.debian.org/security/2018/dsa-4099
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3516#c1
Issue Tracking
https://github.com/FFmpeg/FFmpeg/commit/27f8d386829689c346ff0cef00d3af57b9fb8903
https://github.com/FFmpeg/FFmpeg/commit/58cf31cee7a456057f337b3102a03206d833d5e8
Patch
Vendor Advisory
https://lists.ffmpeg.org/pipermail/ffmpeg-devel/2017-November/219748.html
Issue Tracking
Patch
https://www.debian.org/security/2018/dsa-4099

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:ffmpeg:ffmpeg:3.4:*:*:*:*:*:*:*

EPSS

Процентиль: 66%

0.00526

Низкий

6.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-125

Связанные уязвимости

CVE-2017-17081

CVSS3: 6.5

ubuntu

около 8 лет назад

CVE-2017-17081

CVSS3: 6.5

debian

около 8 лет назад

The gmc_mmx function in libavcodec/x86/mpegvideodsp.c in FFmpeg 2.3 an ...

GHSA-7v4x-624r-2m39

CVSS3: 6.5

github

больше 3 лет назад

EPSS

Процентиль: 66%

0.00526

Низкий

6.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-125