CVE-2017-17081
The gmc_mmx function in libavcodec/x86/mpegvideodsp.c in FFmpeg 2.3 and 3.4 does not properly...
The gmc_mmx function in libavcodec/x86/mpegvideodsp.c in FFmpeg 2.3 and 3.4 does not properly validate widths and heights, which allows remote attackers to cause a denial of service (integer signedness error and out-of-array read) via a crafted MPEG file.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The gmc_mmx function in libavcodec/x86/mpegvideodsp.c in FFmpeg 2.3 and 3.4 does not properly validate widths and heights, which allows remote attackers to cause a denial of service (integer signedness error and out-of-array read) via a crafted MPEG file.
- Record
CVE-2017-17081- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List No score
The gmc_mmx function in libavcodec/x86/mpegvideodsp.c in FFmpeg 2.3 and 3.4 does not properly validate widths and heights, which allows remote attackers to cause a denial of service (integer signedness error and out-of-array read) via a crafted MPEG file.
- Record
CVE-2017-17081- Updated
- 2026-11-02
EUVDEUVD-2017-8247 No score
The gmc_mmx function in libavcodec/x86/mpegvideodsp.c in FFmpeg 2.3 and 3.4 does not properly validate widths and heights, which allows remote attackers to cause a denial of service (integer signedness error and out-of-array read) via a crafted MPEG file.
- Record
EUVD-2017-8247- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7v4x-624r-2m39
The gmc_mmx function in libavcodec/x86/mpegvideodsp.c in FFmpeg 2.3 and 3.4 does not properly...
The gmc_mmx function in libavcodec/x86/mpegvideodsp.c in FFmpeg 2.3 and 3.4 does not properly validate widths and heights, which allows remote attackers to cause a denial of service (integer signedness error and out-of-array read) via a crafted MPEG file.
- Record
GHSA-7v4x-624r-2m39- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSV
The gmc_mmx function in libavcodec/x86/mpegvideodsp.c in FFmpeg 2.3 and 3.4 does not properly validate widths and heights, which allows remote attackers to cause a denial of service (integer signedness error and out-of-array read) via a crafted MPEG file.
- Record
CVE-2017-17081- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-07
OSVDEBIAN-CVE-2017-17081
The gmc_mmx function in libavcodec/x86/mpegvideodsp.c in FFmpeg 2.3 and 3.4 does not properly validate widths and heights, which allows remote attackers to cause a denial of service (integer signedness error and out-of-array read) via a crafted MPEG file.
- Record
DEBIAN-CVE-2017-17081- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVUBUNTU-CVE-2017-17081
The gmc_mmx function in libavcodec/x86/mpegvideodsp.c in FFmpeg 2.3 and 3.4 does not properly validate widths and heights, which allows remote attackers to cause a denial of service (integer signedness error and out-of-array read) via a crafted MPEG file.
- Record
UBUNTU-CVE-2017-17081- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2018-0008 No score
Updated ffmpeg packages fix security vulnerability
This update provides ffmpeg version 2.4.14, which fixes several security vulnerabilities and other bugs which were corrected upstream.
- Record
MGASA-2018-0008- Updated
- 2026-11-02
OSVMGASA-2018-0116 No score
Updated ffmpeg packages fix security vulnerability
This update provides ffmpeg version 3.3.6, which fixes several security vulnerabilities and other bugs which were corrected upstream.
- Record
MGASA-2018-0116- Updated
- 2026-11-02
OSVopenSUSE-SU-2018:0470-1 No score
Security update for ffmpeg
This update for ffmpeg fixes the following issues:
Updated ffmpeg to new bugfix release 3.4.2
- Fix integer overflows, multiplication overflows, undefined shifts, and verify buffer lengths.
- avfilter/vf_transpose: Fix used plane count [boo#1078488, CVE-2018-6392]
- avcodec/utvideodec: Fix bytes left check in decode_frame() [boo#1079368, CVE-2018-6621]
- Enable use of libzvbi for displaying teletext subtitles.
- Fixed a DoS in swri_audio_convert() [boo#1072366, CVE-2017-17555].
Update to new bugfix release 3.4.1
- Fixed integer overflows, division by zero, illegal bit shifts
- Fixed the gmc_mmx function which failed to validate width and height [boo#1070762, CVE-2017-17081]
- Fixed out-of-bounds in VC-2 encoder [boo#1069407, CVE-2017-16840]
- ffplay: use SDL2 audio API
-
install also doc/ffserver.conf
-
Update to new upstream release 3.4
- New video filters: deflicker, doublewave, lumakey, pixscope, oscilloscope, robterts, limiter, libvmaf, unpremultiply, tlut2, floodifll, pseudocolor, despill, convolve, vmafmotion.
- New audio filters: afir, crossfeed, surround, headphone, superequalizer, haas.
- Some video filters with several inputs now use a common set of options: blend, libvmaf, lut3d, overlay, psnr, ssim. They must always be used by name.
- librsvg support for svg rasterization
- spec-compliant VP9 muxing support in MP4
- Remove the libnut and libschroedinger muxer/demuxer wrappers
- drop deprecated qtkit input device (use avfoundation instead)
- SUP/PGS subtitle muxer
- VP9 tile threading support
- KMS screen grabber
- CUDA thumbnail filter
- V4L2 mem2mem HW assisted codecs
- Rockchip MPP hardware decoding
- (Not in openSUSE builds, only original ones:)
- Gremlin Digital Video demuxer and decoder
- Additional frame format support for Interplay MVE movies
- Dolby E decoder and SMPTE 337M demuxer
- raw G.726 muxer and demuxer, left- and right-justified
- NewTek NDI input/output device
- FITS demuxer, muxer, decoder and encoder
-
Fixed a double free in huffyuv [boo#1064577, CVE-2017-15186]
-
Fixed an out-of-bounds in ffv1dec [boo#1066428, CVE-2017-15672]
- Record
openSUSE-SU-2018:0470-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2018:0476-1 No score
Security update for ffmpeg
This update for ffmpeg fixes the following issues:
Updated ffmpeg to new bugfix release 3.4.2
- Fix integer overflows, multiplication overflows, undefined shifts, and verify buffer lengths.
- avfilter/vf_transpose: Fix used plane count [boo#1078488, CVE-2018-6392]
- avcodec/utvideodec: Fix bytes left check in decode_frame() [boo#1079368, CVE-2018-6621]
- Enable use of libzvbi for displaying teletext subtitles.
- Fixed a DoS in swri_audio_convert() [boo#1072366, CVE-2017-17555].
Update to new bugfix release 3.4.1
- Fixed integer overflows, division by zero, illegal bit shifts
- Fixed the gmc_mmx function which failed to validate width and height [boo#1070762, CVE-2017-17081]
- Fixed out-of-bounds in VC-2 encoder [boo#1069407, CVE-2017-16840]
- ffplay: use SDL2 audio API
-
install also doc/ffserver.conf
-
Update to new upstream release 3.4
- New video filters: deflicker, doublewave, lumakey, pixscope, oscilloscope, robterts, limiter, libvmaf, unpremultiply, tlut2, floodifll, pseudocolor, despill, convolve, vmafmotion.
- New audio filters: afir, crossfeed, surround, headphone, superequalizer, haas.
- Some video filters with several inputs now use a common set of options: blend, libvmaf, lut3d, overlay, psnr, ssim. They must always be used by name.
- librsvg support for svg rasterization
- spec-compliant VP9 muxing support in MP4
- Remove the libnut and libschroedinger muxer/demuxer wrappers
- drop deprecated qtkit input device (use avfoundation instead)
- SUP/PGS subtitle muxer
- VP9 tile threading support
- KMS screen grabber
- CUDA thumbnail filter
- V4L2 mem2mem HW assisted codecs
- Rockchip MPP hardware decoding
- (Not in openSUSE builds, only original ones:)
- Gremlin Digital Video demuxer and decoder
- Additional frame format support for Interplay MVE movies
- Dolby E decoder and SMPTE 337M demuxer
- raw G.726 muxer and demuxer, left- and right-justified
- NewTek NDI input/output device
- FITS demuxer, muxer, decoder and encoder
-
Fixed a double free in huffyuv [boo#1064577, CVE-2017-15186]
-
Fixed an out-of-bounds in ffv1dec [boo#1066428, CVE-2017-15672]
- Record
openSUSE-SU-2018:0476-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10754-1 No score
ffmpeg-4-4.4-5.2 on GA media
These are all security issues fixed in the ffmpeg-4-4.4-5.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10754-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ffmpegDebian:12 |
before 7:3.4.1-1 | 7:3.4.1-1 |
ffmpegDebian:13 |
before 7:3.4.1-1 | 7:3.4.1-1 |
ffmpegDebian:14 |
before 7:3.4.1-1 | 7:3.4.1-1 |
ffmpegDebian:9 |
before 7:3.2.10-1~deb9u1, plus listed versions 7:3.2.10-1~deb9u1~bpo8+17:3.2.5-17:3.2.6-17:3.2.7-1~deb9u17:3.2.8-1~deb9u17:3.2.9-1~deb9u1 |
7:3.2.10-1~deb9u1 |
ffmpegMageia:5 From an advisory covering 31 CVEs |
before 2.4.14-1.mga5 | 2.4.14-1.mga5 |
ffmpegMageia:5 From an advisory covering 31 CVEs |
before 2.4.14-1.mga5.tainted | 2.4.14-1.mga5.tainted |
ffmpegMageia:6 From an advisory covering 2 CVEs |
before 3.3.6-1.mga6 | 3.3.6-1.mga6 |
ffmpegMageia:6 From an advisory covering 2 CVEs |
before 3.3.6-1.mga6.tainted | 3.3.6-1.mga6.tainted |
ffmpegUbuntu:16.04:LTS |
before 7:2.8.14-0ubuntu0.16.04.1, plus listed versions 7:2.7.2-1build17:2.8.1-1ubuntu17:2.8.2-1ubuntu17:2.8.3-17:2.8.4-1 Show 9 moreShow less7:2.8.4-1ubuntu17:2.8.4-1ubuntu27:2.8.4-1ubuntu37:2.8.4-1ubuntu47:2.8.6-1ubuntu17:2.8.6-1ubuntu27:2.8.8-0ubuntu0.16.04.17:2.8.10-0ubuntu0.16.04.17:2.8.11-0ubuntu0.16.04.1 |
7:2.8.14-0ubuntu0.16.04.1 |
oxide-qtUbuntu:16.04:LTS |
All versions, plus listed versions 1.9.5-0ubuntu11.10.3-0ubuntu0.15.10.11.10.3-0ubuntu0.15.10.21.11.3-0ubuntu31.11.4-0ubuntu1 Show 17 moreShow less1.11.5-0ubuntu11.12.5-0ubuntu11.12.6-0ubuntu11.12.7-0ubuntu11.13.6-0ubuntu11.14.7-0ubuntu11.14.9-0ubuntu0.16.04.11.15.7-0ubuntu0.16.04.11.15.8-0ubuntu0.16.04.11.16.5-0ubuntu0.16.04.11.17.7-0ubuntu0.16.04.11.17.9-0ubuntu0.16.04.11.18.3-0ubuntu0.16.04.11.18.5-0ubuntu0.16.04.11.19.4-0ubuntu0.16.04.11.20.4-0ubuntu0.16.04.11.21.5-0ubuntu0.16.04.1 |
None known |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
qtwebengine-opensource-srcUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 5.9.1+dfsg-45.9.1+dfsg-4ubuntu15.9.2+dfsg-2ubuntu15.9.3+dfsg-0ubuntu15.9.4+dfsg-0ubuntu15.9.5+dfsg-0ubuntu25.9.5+dfsg-0ubuntu2+esm1 |
None known |
qtwebengine-opensource-srcUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 5.12.4+dfsg-1ubuntu15.12.4+dfsg-1ubuntu35.12.5+dfsg-3ubuntu15.12.5+dfsg-6ubuntu25.12.5+dfsg-7 Show 4 moreShow less5.12.5+dfsg-7build15.12.8+dfsg-0ubuntu15.12.8+dfsg-0ubuntu1.15.12.8+dfsg-0ubuntu1.1+esm1 |
None known |
qtwebengine-opensource-srcUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 5.15.6+dfsg-15.15.6+dfsg-25.15.7+dfsg-25.15.8+dfsg-15.15.8+dfsg-1build1 Show 4 moreShow less5.15.8+dfsg-1build25.15.8+dfsg-25.15.9+dfsg-15.15.9+dfsg-1ubuntu0.1~esm1 |
None known |
qtwebengine-opensource-srcUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 5.15.15+dfsg-25.15.15+dfsg-2build25.15.15+dfsg-2ubuntu15.15.16+dfsg-15.15.16+dfsg-1ubuntu25.15.16+dfsg-1ubuntu45.15.16+dfsg-35.15.16+dfsg-3ubuntu0.1~esm1 |
None known |
qtwebengine-opensource-srcUbuntu:25.10 |
All versions, plus listed versions 5.15.18+dfsg-25.15.18+dfsg-2build15.15.19+dfsg-15.15.19+dfsg2-1 |
None known |
qtwebengine-opensource-srcUbuntu:26.10 |
All versions, plus listed versions 5.15.19+dfsg2-45.15.19+dfsg2-65.15.19+dfsg2-7 |
None known |
qtwebengine-opensource-srcUbuntu:Pro:26.04:LTS |
All versions, plus listed versions 5.15.19+dfsg2-15.15.19+dfsg2-1build15.15.19+dfsg2-25.15.19+dfsg2-35.15.19+dfsg2-45.15.19+dfsg2-4ubuntu0.1~esm1 |
None known |
ffmpegSUSE:Package Hub 12 SP2 From an advisory covering 7 CVEs |
before 3.4.2-14.1 | 3.4.2-14.1 |
ffmpeg-4openSUSE:Tumbleweed From an advisory covering 46 CVEs |
before 4.4-5.2 | 4.4-5.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-17081 is a medium vulnerability (CVSS 6.5) in Ffmpeg, published November 30, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.83%, the 78th percentile. Fixed in ffmpeg 7:3.4.1-1.
References
lists.ffmpeg.org/pipermail/ffmpeg-devel/2017-November/219748.html
bugs.chromium.org/p/oss-fuzz/issues/detail?id=3516
github.com/FFmpeg/FFmpeg/commit/58cf31cee7a456057f337b3102a03206d833d5e8
debian.org/security/2018/dsa-4099
nvd.nist.gov/vuln/detail/CVE-2017-17081
Show 64 moreShow less
security-tracker.debian.org/tracker/CVE-2017-17081
advisories.mageia.org/MGASA-2018-0008.html
bugs.mageia.org/show_bug.cgi?id=20757
git.ffmpeg.org/gitweb/ffmpeg.git/shortlog/n3.3.6
ffmpeg.org/download.html
ubuntu.com/security/CVE-2017-17081
cve.org/CVERecord?id=CVE-2017-17081
bugzilla.suse.com/1064577
suse.com/security/cve/CVE-2017-15186