CVE-2017-14222
First published: Sat Sep 09 2017(Updated: )
In libavformat/mov.c in FFmpeg 3.3.3, a DoS in read_tfra() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted MOV file, which claims a large "item_count" field in the header but does not contain sufficient backing data, is provided, the loop would consume huge CPU and memory resources, since there is no EOF check inside the loop.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| FFmpeg | =3.3.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2017-14222?
CVE-2017-14222 is classified as a moderate severity vulnerability due to its potential for denial of service.
How do I fix CVE-2017-14222?
To fix CVE-2017-14222, update FFmpeg to a version later than 3.3.3 that addresses the EOF check issue.
What are the potential impacts of CVE-2017-14222?
The potential impacts of CVE-2017-14222 include excessive CPU and memory usage leading to denial of service.
Which versions of FFmpeg are affected by CVE-2017-14222?
CVE-2017-14222 specifically affects FFmpeg version 3.3.3.
Can CVE-2017-14222 be exploited remotely?
Yes, CVE-2017-14222 can be exploited remotely by providing a crafted MOV file to the affected application.
- agent/type
- agent/references
- agent/remedy
- agent/weakness
- agent/severity
- agent/author
- agent/softwarecombine
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/first-publish-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/ffmpeg
- canonical/ffmpeg
- version/ffmpeg/3.3.3