CVE-2017-14767

NameCVE-2017-14767
DescriptionThe sdp_parse_fmtp_config_h264 function in libavformat/rtpdec_h264.c in FFmpeg before 3.3.4 mishandles empty sprop-parameter-sets values, which allows remote attackers to cause a denial of service (heap buffer overflow) or possibly have unspecified other impact via a crafted sdp file.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-1630-1, DSA-3996-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
ffmpeg (PTS)bullseye (security), bullseye7:4.3.7-0+deb11u1fixed
bookworm, bookworm (security)7:5.1.6-0+deb12u1fixed
sid, trixie7:7.0.2-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
ffmpegsourcestretch7:3.2.8-1~deb9u1DSA-3996-1
ffmpegsource(unstable)7:3.3.4-1
libavsourcejessie6:11.12-1~deb8u4DLA-1630-1
libavsource(unstable)(unfixed)

Notes

https://github.com/FFmpeg/FFmpeg/commit/c42a1388a6d1bfd8001bf6a4241d8ca27e49326d
Fixed in 3.2.8
The check is completely missing in Jessie. It should be added.

Search for package or bug name: Reporting problems