CVE-2017-17555: Denial of Service in FFmpeg libswresample

aubio Updated 02 Oct 2025

Summary

12/12/2017

Disclosed on

CVE-2017-17555

CVE

Yes i

Fix available

Unrated

Severity

Not published

CVSS Score

CVE-2017-17555: The swri_audio_convert function in audioconvert.c in FFmpeg libswresample through 3.0.101, as used in FFmpeg 3.4.1, aubio 0.4.6, and other products, allows remote attackers to cause a denial of service (NULL pointer dere... Affects aubio versions < 0.4.7. Fixed in 0.4.7. How to fix ↓

Also tracked for

aubio · Debian:11

The same CVE-2017-17555 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

FFmpeg is a popular open-source multimedia framework that provides a set of tools for handling multimedia data. It includes libraries such as libswresample, which is responsible for audio conversion. Aubio is one of the products that utilize FFmpeg's libswresample. Aubio is a Python library for audio analysis and processing. The vulnerability identified as CVE-2017-17555 affects FFmpeg 3.4.1, Aubio 0.4.6, and potentially other products that use libswresample. This vulnerability allows remote attackers to cause a denial of service by exploiting a NULL pointer dereference in the swri_audio_convert function of audioconvert.c. By crafting a malicious audio file, an attacker can trigger this vulnerability and crash the application.

Vulnerability Detail

The vulnerability (CVE-2017-17555) arises from a NULL pointer dereference in the swri_audio_convert function of audioconvert.c in FFmpeg libswresample. When processing a specially crafted audio file, the function fails to handle a NULL pointer properly, leading to a crash of the application. This vulnerability can be exploited remotely by an attacker. The impact of this vulnerability is a denial of service, as the application crashes due to the NULL pointer dereference. It is important to note that this vulnerability only affects versions of FFmpeg up to 3.4.1 and Aubio up to 0.4.6.

How To Fix

Minimum fixed version

0.4.7

This is the first release that contains the fix.

pip install --upgrade "aubio==0.4.7"

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

There is no specific workaround mentioned for this vulnerability. The recommended approach is to update the affected packages to the fixed versions.

Conclusion

The vulnerability (CVE-2017-17555) in FFmpeg libswresample allows remote attackers to cause a denial of service by exploiting a NULL pointer dereference. This vulnerability affects FFmpeg versions up to 3.4.1 and Aubio versions up to 0.4.6. To mitigate the risk, it is crucial to update the affected packages to the fixed versions. For FFmpeg, update to version 3.0.101 or later, and for Aubio, update to version 0.4.7 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for aubio →