CVE-2016-20099: L-SMASH through 2.14.5 Infinite Loop in VC-1 Importer Probe
L-SMASH through 2.14.5 contains an infinite loop vulnerability in vc1importerprobe() in importer/vc1imp.c that allows attackers to hang applications via crafted input files. Attackers can supply a file consisting only of zero bytes, which lsmashreadfile() probes automatically, causing indefinite CPU consumption and denial of service.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using L-SMASH through 2.14.5 are exposed when they process attacker-supplied input files. The affected probing path is invoked automatically by lsmash_read_file().
What does an attacker need to exploit it?
An attacker needs to provide a crafted input file to an application that reads it with the affected L-SMASH functionality. A file containing only zero bytes can trigger the infinite loop.
What is the practical impact?
Processing the crafted file can cause indefinite CPU consumption and hang the application, resulting in a denial of service. The supplied severity vector indicates local attack vector and user interaction is required.