CVE-2017-14795
HighSummary
The hevc_write_frame function in libbpg.c in libbpg 0.9.7 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted BPG file. The issue is related to improper interaction with hls_pcm_sample in hevc.c and put_pcm_var in hevcdsp_template.c in FFmpeg.
Risk Assessment
Attackers may exploit this vulnerability to remotely trigger application crashes, leading to service availability interruptions. It may also result in other unspecified impacts on the system.
Recommendation
It is recommended to update libbpg to the latest version to mitigate this vulnerability. Additionally, monitor and restrict access to applications processing BPG files.
Other vulnerabilities in libbpg 0.9.7
See all- CVE-2017-13136High
The image_alloc function in bpgenc.c in libbpg version 0.9.7 has an integer overflow, resulting in an invalid malloc and NULL pointer dereference.
- CVE-2017-14796High
The hevc_write_frame function in libbpg.c in libbpg 0.9.7 allows remote attackers to cause a denial of service (integer underflow and application crash) or possibly have unspecified other impact via a crafted BPG file.
- CVE-2017-14734High
The build_msps function in libbpg.c in libbpg 0.9.7 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted BPG file, related to hevc_decode_init1.
- CVE-2016-5637High
The restore_tqb_pixels function in libbpg versions 0.9.5 through 0.9.7 mishandles the transquant_bypass_enable_flag value, allowing remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via a crafted BPG image, related to a 'type confusion' issue.
Original NVD description (English source)
The hevc_write_frame function in libbpg.c in libbpg 0.9.7 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a crafted BPG file, related to improper interaction with hls_pcm_sample in hevc.c in libavcodec in FFmpeg and put_pcm_var in hevcdsp_template.c in libavcodec in FFmpeg.