CVE-2017-17081 — Out-of-bounds Read in Ffmpeg

CWE-125 — Out-of-bounds Read4 documents4 sources
Severity
6.5MEDIUMNVD
EPSS
0.5%
top 32.95%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
FfmpegDebian Ffmpeg
Timeline
PublishedNov 30
Latest updateMay 13

Description

The gmc_mmx function in libavcodec/x86/mpegvideodsp.c in FFmpeg 2.3 and 3.4 does not properly validate widths and heights, which allows remote attackers to cause a denial of service (integer signedness error and out-of-array read) via a crafted MPEG file.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶debiandebian/ffmpeg< ffmpeg 7:3.4.1-1 (bookworm)
▶Debianffmpeg/ffmpeg< 7:3.4.1-1+3
▶NVDffmpeg/ffmpeg3.4

Patches

Patch: github.com ↗Patch: lists.ffmpeg.org ↗Patch: github.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-7v4x-624r-2m39: The gmc_mmx function in libavcodec/x86/mpegvideodsp↗2022-05-13
▶
OSV
CVE-2017-17081: The gmc_mmx function in libavcodec/x86/mpegvideodsp↗2017-11-30
▶

📋Vendor Advisories

1
Debian
CVE-2017-17081: ffmpeg - The gmc_mmx function in libavcodec/x86/mpegvideodsp.c in FFmpeg 2.3 and 3.4 does...↗2017
▶