CVE-2017-14223

NameCVE-2017-14223
DescriptionIn libavformat/asfdec_f.c in FFmpeg 3.3.3, a DoS in asf_build_simple_index() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted ASF file, which claims a large "ict" field in the header but does not contain sufficient backing data, is provided, the for loop would consume huge CPU and memory resources, since there is no EOF check inside the loop.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
NVD severityhigh (attack range: remote)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
ffmpeg (PTS)stretch7:3.2.5-1vulnerable
stretch (security)7:3.2.7-1~deb9u1vulnerable
buster, sid7:3.3.4-1fixed
libav (PTS)wheezy6:0.8.17-2undetermined
wheezy (security)6:0.8.20-0+deb7u1undetermined
jessie (security), jessie6:11.9-1~deb8u1undetermined

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
ffmpegsource(unstable)7:3.3.4-1low
libavsource(unstable)undeterminedhigh

Notes

[stretch] - ffmpeg <postponed> (Can be fixed along when more severe issues are being fixed)
https://github.com/FFmpeg/FFmpeg/commit/afc9c683ed9db01edb357bc8c19edad4282b3a97

Search for package or bug name: Reporting problems