CVE-2017-14058 - In FFmpeg 2.4 and 3.3.3, the read_data function in libavformat/hls.c does not restrict reload attemp

CVE-2017-14058

Summary

In FFmpeg 2.4 and 3.3.3, the read_data function in libavformat/hls.c does not restrict reload attempts for an insufficient list, which allows remote attackers to cause a denial of service (infinite loop).

References

http://www.debian.org/security/2017/dsa-3996
http://www.securityfocus.com/bid/100629
https://github.com/FFmpeg/FFmpeg/commit/7ba100d3e6e8b1e5d5342feb960a7f081d6e15af
https://github.com/FFmpeg/FFmpeg/commit/7ec414892ddcad88313848494b6fc5f437c9ca4a
https://lists.debian.org/debian-lts-announce/2019/03/msg00041.html

Vulnerable Configurations

cpe:2.3:a:ffmpeg:ffmpeg:3.3.3:*:*:*:*:*:*:*
cpe:2.3:a:ffmpeg:ffmpeg:3.3.3:*:*:*:*:*:*:*

CVSS

Base:	4.3 (as of 29-12-2020 - 21:15)
Impact:
Exploitability:

CWE

CWE-835

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
NONE	NONE	PARTIAL

cvss-vector via4

AV:N/AC:M/Au:N/C:N/I:N/A:P

refmap via4

bid	100629
confirm	https://github.com/FFmpeg/FFmpeg/commit/7ec414892ddcad88313848494b6fc5f437c9ca4a
debian	DSA-3996
misc	https://github.com/FFmpeg/FFmpeg/commit/7ba100d3e6e8b1e5d5342feb960a7f081d6e15af
mlist	[debian-lts-announce] 20190330 [SECURITY] [DLA 1740-1] libav security update

Last major update

29-12-2020 - 21:15

Published

31-08-2017 - 15:29

Last modified

29-12-2020 - 21:15