CVE-2017-17130
HighSummary
The ff_free_picture_tables function in libavcodec/mpegpicture.c in Libav 12.2 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.
Risk Assessment
An attacker could exploit this vulnerability to remotely crash the application, leading to service unavailability. This may affect system stability and user trust.
Recommendation
It is recommended to update Libav to the latest version to mitigate this vulnerability and to monitor systems for suspicious activity related to media file processing.
Other vulnerabilities in Libav 12.2
See all- CVE-2017-17129High
The ff_vc1_mc_4mv_chroma4 function in libavcodec/vc1_mc.c in Libav 12.2 allows remote attackers to cause a denial of service (segmentation fault and application crash) or possibly have unspecified other impact via a crafted file.
- CVE-2017-16803High
In Libav through 11.11 and 12.x through 12.1, the smacker_decode_tree function in libavcodec/smacker.c does not properly restrict tree recursion, allowing remote attackers to cause a denial of service via a crafted Smacker stream.
- CVE-2017-11684High
There is an illegal address access in the build_table function in libavcodec/bitstream.c of Libav 12.1 that may lead to remote denial of service via crafted input.
- CVE-2017-9987High
There is a heap-based buffer overflow in the function hpel_motion in mpegvideo_motion.c in libav 12.1. A crafted input can lead to a remote denial of service attack.
- CVE-2014-3984High
Multiple unspecified vulnerabilities in Libav before version 0.8.12 may allow remote attackers to achieve unknown impact and vectors.
- CVE-2017-9051Critical
Libav versions before 12.1 are vulnerable to an invalid read of size 1 due to NULL pointer dereferencing in the nsv_read_chunk function in libavformat/nsvdec.c.
Original NVD description (English source)
The ff_free_picture_tables function in libavcodec/mpegpicture.c in Libav 12.2 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file, related to vc1_decode_i_blocks_adv.