Vulnerability in Ffmpeg
CVE-2017-14055
In libavformat/mvdec.c in FFmpeg 3.3.3, a DoS in mv_read_header() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted MV file, which claims a large "nb_frames" field in the header but does not contain sufficient backing data, is provided, the loop over the frames would consume huge CPU and memory resources, since there is no EOF check inside the loop.
EPSS: 0.018 (76.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H.
Affected products
- Ffmpeg — versions 3.3.3
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (vdb-entry, x_refsource_BID)
- cve@mitre.org (x_refsource_CONFIRM, Patch, Third Party Advisory)
- cve@mitre.org (mailing-list, x_refsource_MLIST)
- cve@mitre.org (vendor-advisory, x_refsource_DEBIAN)
Frequently asked questions
- What is CVE-2017-14055?
- CVE-2017-14055 is a medium-severity vulnerability in Ffmpeg, classified under Excessive Iteration. CVSS score: 6.5/10. Published 2017-08-31.
- How severe is CVE-2017-14055?
- Medium severity. CVSS v3 base score is 6.5 out of 10.