Denial of Service Vulnerability in libquicktime: CVE-2017-12145
Summary
DEBIAN-CVE-2017-12145: In libquicktime 1.2.4, an allocation failure was found in the function quicktime_read_ftyp in ftyp.c, which allows attackers to cause a denial of service via a crafted file. Affects libquicktime versions 2:1.2.4-12 – 2:1.2.4-17. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libquicktime is an open-source library designed for reading and writing QuickTime files. It provides functionalities for multimedia applications to handle video and audio data efficiently. However, certain versions of libquicktime are susceptible to a vulnerability that can be exploited through specially crafted files, leading to potential denial of service attacks.
Vulnerability Detail
The vulnerability identified as CVE-2017-12145 arises from an allocation failure in the function quicktime_read_ftyp located in ftyp.c of libquicktime version 1.2.4. Attackers can exploit this flaw by providing a maliciously crafted file that triggers the allocation failure, resulting in a denial of service condition. This vulnerability affects multiple Debian versions, including Debian 11, 12, 13, and 14, and is classified as having unimportant urgency.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid opening or processing QuickTime files from untrusted sources. Implementing strict file validation and sanitization can help mitigate the risk of exploitation until a patch is applied.
Conclusion
CVE-2017-12145 represents a significant denial of service vulnerability in libquicktime that can be exploited through malicious QuickTime files. Users are advised to update their packages promptly and implement workarounds to mitigate risks until a fix is applied.
See every vulnerability recorded for libquicktime →
FAQ
CVE-2017-12145 is a vulnerability in libquicktime that can lead to denial of service due to an allocation failure when processing specially crafted QuickTime files.
The vulnerability affects libquicktime versions in Debian 11, 12, 13, and 14.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, ensure to avoid processing untrusted QuickTime files and implement file validation to reduce risk.
For more information on vulnerabilities and how to monitor them, you can visit Vulert at https://vulert.com, which provides real-time alerts for open-source vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for libquicktime.
