In Libav through 11.11 and 12.x through 12.1, the smacker_decode_tree function in libavcodec/smacker.c does not properly restrict tree recursion, which allows remote attackers to cause a denial of service (bitstream.c:build_table() out-of-bounds read and application crash) via a crafted Smacker stream.
References
| Link | Resource |
|---|---|
| http://www.securityfocus.com/bid/101882 | Third Party Advisory VDB Entry |
| https://bugzilla.libav.org/show_bug.cgi?id=1098 | Issue Tracking |
| https://github.com/libav/libav/commit/cd4663dc80323ba64989d0c103d51ad3ee0e9c2f | Issue Tracking |
| https://security.gentoo.org/glsa/201811-19 | |
| https://www.debian.org/security/2018/dsa-4119 | |
| http://www.securityfocus.com/bid/101882 | Third Party Advisory VDB Entry |
| https://bugzilla.libav.org/show_bug.cgi?id=1098 | Issue Tracking |
| https://github.com/libav/libav/commit/cd4663dc80323ba64989d0c103d51ad3ee0e9c2f | Issue Tracking |
| https://security.gentoo.org/glsa/201811-19 | |
| https://www.debian.org/security/2018/dsa-4119 |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 03:17
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.securityfocus.com/bid/101882 - Third Party Advisory, VDB Entry | |
| References | () https://bugzilla.libav.org/show_bug.cgi?id=1098 - Issue Tracking | |
| References | () https://github.com/libav/libav/commit/cd4663dc80323ba64989d0c103d51ad3ee0e9c2f - Issue Tracking | |
| References | () https://security.gentoo.org/glsa/201811-19 - | |
| References | () https://www.debian.org/security/2018/dsa-4119 - |
Information
Published : 2017-11-13 17:29
Updated : 2024-11-21 03:17
NVD link : CVE-2017-16803
Mitre link : CVE-2017-16803
CVE.ORG link : CVE-2017-16803
JSON object : View
Products Affected
libav
- libav
CWE
CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer