Critical DoS Vulnerability in FFmpeg Package: CVE-2017-14055
Summary
ALPINE-CVE-2017-14055: In libavformat/mvdec.c in FFmpeg 3.3.3, a DoS in mv_read_header() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. Affects ffmpeg versions < 3.1.11-r0. Fixed in 3.1.11-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FFmpeg is a widely used open-source software suite for handling multimedia data, including audio and video processing. It provides a rich set of tools for encoding, decoding, transcoding, muxing, demuxing, streaming, filtering, and playing almost anything that humans and machines have created in the realm of multimedia. However, FFmpeg has been found to have a vulnerability that can lead to Denial of Service (DoS) attacks, particularly affecting versions prior to the patched releases.
Vulnerability Detail
In libavformat/mvdec.c of FFmpeg version 3.3.3, a critical vulnerability exists due to a lack of an EOF (End of File) check in the mv_read_header() function. This oversight allows an attacker to craft a malicious MV file that claims a large 'nb_frames' field in the header without providing sufficient backing data. As a result, the application enters an infinite loop, consuming excessive CPU and memory resources, which can lead to a Denial of Service condition.
How To Fix
Minimum fixed version
3.1.11-r0
This is the first release that contains the fix.
sudo apk add --upgrade ffmpegTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted or potentially malicious MV files until the package is updated. Implementing strict validation checks on input files can also help mitigate the risk.
Conclusion
The CVE-2017-14055 vulnerability in FFmpeg poses a significant risk of Denial of Service due to improper handling of MV files. Users are strongly advised to update their FFmpeg packages to the latest patched versions to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities in open-source software effectively.
See every vulnerability recorded for ffmpeg →
FAQ
CVE-2017-14055 is a vulnerability in FFmpeg that can lead to Denial of Service due to excessive CPU and memory consumption when processing crafted MV files.
FFmpeg versions prior to the patched releases are affected, specifically versions 3.3.3 and earlier in the Alpine Linux ecosystem.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
If exploited, this vulnerability can lead to Denial of Service, causing the application to become unresponsive and consume significant system resources.
Yes, avoid processing untrusted MV files and implement strict validation checks on input files to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for ffmpeg.
