Skip to main content

Excessive Iteration

CVE-2017-14055

Medium
6.5/10

Summary

FFmpeg, in "mv_read_header()" the file "libavformat/mvdec.c", versions through 2.4.13, 2.5-dev through 2.8.12, 3.0-dev through 3.0.9, 3.1-dev through 3.1.10, 3.2-dev through 3.2.9, and 3.3-dev through 3.3.2, has a DoS due to the lack of an EOF (End of File) check. This might cause a huge CPU and memory consumption. When a crafted MV file, which claims a large "nb_frames" field in the header but does not contain sufficient backing data is provided, the loop over the frames would consume huge CPU and memory resources, since there is no EOF check inside the loop.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • REQUIRED
  • NONE
  • NONE
  • HIGH

CWE-834 - Excessive Iteration

The software performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.

References

Advisory Timeline

  • Published