CVE-2017-17555: Denial of Service in FFmpeg libswresample
Summary
CVE-2017-17555: The swri_audio_convert function in audioconvert.c in FFmpeg libswresample through 3.0.101, as used in FFmpeg 3.4.1, aubio 0.4.6, and other products, allows remote attackers to cause a denial of service (NULL pointer dere... Affects aubio across 3 version ranges.
< 0.4.6-1
< bc839fb39dc376d462856863de2933f0b6b0351a
< c6ae035aa79571f3c04640652e0020580e03c195
Fixed in 0.4.6-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FFmpeg is a popular open-source multimedia framework used for handling audio, video, and other media streams. The libswresample library within FFmpeg is responsible for audio conversion. It is utilized by various products, including aubio, a music analysis tool. However, a vulnerability has been discovered in libswresample that can lead to a denial of service (DoS) attack when processing a specially crafted audio file.
Vulnerability Detail
The vulnerability, identified as CVE-2017-17555, arises due to a flaw in the swri_audio_convert function in audioconvert.c. By exploiting this flaw, remote attackers can trigger a NULL pointer dereference, causing the application to crash. This vulnerability can be exploited by providing a malicious audio file to an application that utilizes FFmpeg libswresample, resulting in a DoS condition. The severity of this vulnerability is rated as low, with a CVSS v3 score of 6.5.
How To Fix
Minimum fixed version
0.4.6-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade aubioTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No known workarounds are available for this vulnerability.
Conclusion
The vulnerability in FFmpeg libswresample can be exploited to cause a DoS condition in applications that utilize this library. It is crucial to update the affected packages to the fixed version to mitigate the risk. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for aubio →
FAQ
The vulnerability can be exploited remotely to cause a DoS condition, leading to the crashing of the affected application.
FFmpeg versions up to 3.4.1 and aubio version 0.4.6 are affected by this vulnerability.
No known exploits for this vulnerability have been reported at the time of this advisory.
Yes, the CVSS v3 score for this vulnerability is 6.5 (Medium severity).
For more detailed information about this vulnerability, you can refer to the official CVE-2017-17555 entry or the provided database-specific source link.
Related vulnerabilities
Recent vulnerabilities recorded for aubio.
