CVE-2017-17555: Null Pointer Dereference
First published: Tue Dec 12 2017(Updated: )
The swri_audio_convert function in audioconvert.c in FFmpeg libswresample through 3.0.101, as used in FFmpeg 3.4.1, aubio 0.4.6, and other products, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted audio file.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Aubio Aubio | =0.4.6 | |
| FFmpeg FFmpeg | =3.4.1 | |
| FFmpeg libswresample | <=3.0.101 | |
| debian/aubio | 0.4.9-4 0.4.9-4.3 0.4.9-4.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/aubio/aubio/commit/265fe9a2ca606f8b9ae4a110390f26c139c01ad7
- https://github.com/IvanCql/vulnerability/blob/master/An%20NULL%20pointer%20dereference(DoS)%20Vulnerability%20was%20found%20in%20function%20swri_audio_convert%20of%20ffmpeg%20libswresample.md
- https://github.com/aubio/aubio/issues/137
- https://security-tracker.debian.org/tracker/CVE-2017-17555
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00012.html
Frequently Asked Questions
What is the severity of CVE-2017-17555?
The severity of CVE-2017-17555 is medium.
How does CVE-2017-17555 affect Aubio?
Aubio versions 0.4.6-2, 0.4.9-4, and 0.4.9-4.3 are affected by CVE-2017-17555.
How does CVE-2017-17555 affect FFmpeg?
FFmpeg version 3.4.1 is affected by CVE-2017-17555.
What is the remedy for CVE-2017-17555 in Aubio?
The recommended remedy for CVE-2017-17555 in Aubio is to update to version 0.4.9-4.3.
What is the remedy for CVE-2017-17555 in FFmpeg?
The recommended remedy for CVE-2017-17555 in FFmpeg is to update to a version beyond 3.0.101.
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/references
- agent/author
- agent/severity
- agent/weakness
- agent/softwarecombine
- agent/tags
- agent/description
- agent/event
- collector/security-tracker-debian
- source/Debian
- agent/software-canonical-lookup
- vendor/aubio
- canonical/aubio aubio
- version/aubio aubio/0.4.6
- vendor/ffmpeg
- canonical/ffmpeg ffmpeg
- version/ffmpeg ffmpeg/3.4.1
- canonical/ffmpeg libswresample
- version/ffmpeg libswresample/3.0.101
- package-manager/debian