CVE-2017-17555: Null Pointer Dereference
The swriaudioconvert function in audioconvert.c in FFmpeg libswresample through 3.0.101, as used in FFmpeg 3.4.1, aubio 0.4.6, and other products, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted audio file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/aubioto a version that resolves this vulnerability.Fixed in 0.4.9-4Fixed in 0.4.9-4.3Fixed in 0.4.9-4.4
Event History
Frequently Asked Questions
What is the severity of CVE-2017-17555?
The severity of CVE-2017-17555 is medium.
How does CVE-2017-17555 affect Aubio?
Aubio versions 0.4.6-2, 0.4.9-4, and 0.4.9-4.3 are affected by CVE-2017-17555.
How does CVE-2017-17555 affect FFmpeg?
FFmpeg version 3.4.1 is affected by CVE-2017-17555.
What is the remedy for CVE-2017-17555 in Aubio?
The recommended remedy for CVE-2017-17555 in Aubio is to update to version 0.4.9-4.3.
What is the remedy for CVE-2017-17555 in FFmpeg?
The recommended remedy for CVE-2017-17555 in FFmpeg is to update to a version beyond 3.0.101.