CVE-2017-14170

In libavformat/mxfdec.c in FFmpeg 3.3.3 -> 2.4, a DoS in mxf_read_index_entry_array() due to lack of an EOF (End of File) check might cause huge CPU…

published September 7, 2017

CVSS
—
EPSS
2%
Percentile
77.8
In the wild
Unconfirmed
What it is

In libavformat/mxfdec.c in FFmpeg 3.3.3 -> 2.4, a DoS in mxf_read_index_entry_array() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted MXF file, which claims a large "nb_index_entries" field in the header but does not contain sufficient backing data, is provided, the loop would consume huge CPU resources, since there is no EOF check inside the loop. Moreover, this big loop can be invoked multiple times if there is more than one applicable data segment in the crafted MXF file.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01768 · 77.8th percentile
Published
2017-09-07T06:00Z
EPSS history
Timeline
  • 07 SEP 06:00Z
    In libavformat/mxfdec.c in FFmpeg 3.3.3 -> 2.4, a DoS in mxf_read_index_entry_array() due to lack of an EOF (End of File) check might cause huge CPU…
    cvelistv5