CVE-2017-14055

NameCVE-2017-14055
DescriptionIn libavformat/mvdec.c in FFmpeg 3.3.3, a DoS in mv_read_header() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted MV file, which claims a large "nb_frames" field in the header but does not contain sufficient backing data, is provided, the loop over the frames would consume huge CPU and memory resources, since there is no EOF check inside the loop.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-1630-1, DSA-3996-1
NVD severityhigh

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
ffmpeg (PTS)stretch7:3.2.14-1~deb9u1fixed
stretch (security)7:3.2.15-0+deb9u4fixed
buster, buster (security)7:4.1.6-1~deb10u1fixed
bullseye7:4.3.2-0+deb11u2fixed
bookworm, sid7:4.4-6fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
ffmpegsourcestretch7:3.2.8-1~deb9u1DSA-3996-1
ffmpegsource(unstable)7:3.3.4-1low
libavsourcejessie6:11.12-1~deb8u4DLA-1630-1
libavsource(unstable)(unfixed)

Notes

https://github.com/FFmpeg/FFmpeg/commit/4f05e2e2dc1a89f38cd9f0960a6561083d714f1e

Search for package or bug name: Reporting problems