CVE-2017-14223
First published: Sat Sep 09 2017(Updated: )
In libavformat/asfdec_f.c in FFmpeg 3.3.3, a DoS in asf_build_simple_index() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted ASF file, which claims a large "ict" field in the header but does not contain sufficient backing data, is provided, the for loop would consume huge CPU and memory resources, since there is no EOF check inside the loop.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| FFmpeg | =3.3.3 | |
| Debian GNU/Linux | =8.0 | |
| Debian GNU/Linux | =9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2017-14223?
CVE-2017-14223 is classified as a denial of service vulnerability due to potential CPU exhaustion.
How do I fix CVE-2017-14223?
To fix CVE-2017-14223, upgrade to FFmpeg version 3.3.4 or later to ensure proper EOF checks.
What software is affected by CVE-2017-14223?
CVE-2017-14223 affects FFmpeg version 3.3.3 and also impacts Debian GNU/Linux versions 8.0 and 9.0.
What causes the vulnerability CVE-2017-14223?
CVE-2017-14223 is caused by a lack of End of File checks in the asf_build_simple_index() function when handling crafted ASF files.
Can CVE-2017-14223 be exploited remotely?
Yes, CVE-2017-14223 can be exploited remotely if a user opens a malicious ASF file.
- agent/references
- agent/remedy
- agent/weakness
- agent/severity
- agent/author
- agent/description
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/first-publish-date
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/ffmpeg
- canonical/ffmpeg
- version/ffmpeg/3.3.3
- vendor/debian
- canonical/debian gnu/linux
- version/debian gnu/linux/8.0
- version/debian gnu/linux/9.0