CVE-2017-17555: Null Pointer Dereference
Published Dec 12, 2017
·Updated
The swriaudioconvert function in audioconvert.c in FFmpeg libswresample through 3.0.101, as used in FFmpeg 3.4.1, aubio 0.4.6, and other products, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted audio file.
Affected Software
4 affected componentsFixes available
debian/aubio
0.4.9-40.4.9-4.30.4.9-4.4
aubio aubio=0.4.6
FFmpeg FFmpeg=3.4.1
FFmpeg libswresample<=3.0.101
Event History
Dec 12, 2017
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-17555?
The severity of CVE-2017-17555 is medium.
2
How does CVE-2017-17555 affect Aubio?
Aubio versions 0.4.6-2, 0.4.9-4, and 0.4.9-4.3 are affected by CVE-2017-17555.
3
How does CVE-2017-17555 affect FFmpeg?
FFmpeg version 3.4.1 is affected by CVE-2017-17555.
4
What is the remedy for CVE-2017-17555 in Aubio?
The recommended remedy for CVE-2017-17555 in Aubio is to update to version 0.4.9-4.3.
5
What is the remedy for CVE-2017-17555 in FFmpeg?
The recommended remedy for CVE-2017-17555 in FFmpeg is to update to a version beyond 3.0.101.