ID CVE-2017-14056
Summary In libavformat/rl2.c in FFmpeg 3.3.3, a DoS in rl2_read_header() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted RL2 file, which claims a large "frame_count" field in the header but does not contain sufficient backing data, is provided, the loops (for offset and size tables) would consume huge CPU and memory resources, since there is no EOF check inside these loops.
References
Vulnerable Configurations
  • cpe:2.3:a:ffmpeg:ffmpeg:3.3.3:*:*:*:*:*:*:*
    cpe:2.3:a:ffmpeg:ffmpeg:3.3.3:*:*:*:*:*:*:*
CVSS
Base: 7.1 (as of 03-10-2019 - 00:03)
Impact:
Exploitability:
CWE CWE-834
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE COMPLETE
cvss-vector via4 AV:N/AC:M/Au:N/C:N/I:N/A:C
refmap via4
bid 100628
confirm https://github.com/FFmpeg/FFmpeg/commit/96f24d1bee7fe7bac08e2b7c74db1a046c9dc0de
debian DSA-3996
mlist [debian-lts-announce] 20190107 [SECURITY] [DLA 1630-1] libav security update
Last major update 03-10-2019 - 00:03
Published 31-08-2017 - 15:29
Last modified 03-10-2019 - 00:03
Back to Top