CVE-2017-9255 - The mp4ff_read_stsc function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2)

CVE-2017-9255

Summary

The mp4ff_read_stsc function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of service (large loop and CPU consumption) via a crafted mp4 file.

References

http://seclists.org/fulldisclosure/2017/Jun/32

Vulnerable Configurations

cpe:2.3:a:audiocoding:freeware_advanced_audio_decoder_2:2.7:*:*:*:*:*:*:*
cpe:2.3:a:audiocoding:freeware_advanced_audio_decoder_2:2.7:*:*:*:*:*:*:*

CVSS

Base:	7.1 (as of 03-10-2019 - 00:03)
Impact:
Exploitability:

CWE

CWE-834

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
NONE	NONE	COMPLETE

cvss-vector via4

AV:N/AC:M/Au:N/C:N/I:N/A:C

refmap via4

misc

http://seclists.org/fulldisclosure/2017/Jun/32

Last major update

03-10-2019 - 00:03

Published

27-06-2017 - 12:29

Last modified

03-10-2019 - 00:03