CVE-2017-14223
In libavformat/asfdec_f.c in FFmpeg 3.3.3, a DoS in asf_build_simple_index() due to lack of an...
In libavformat/asfdec_f.c in FFmpeg 3.3.3, a DoS in asf_build_simple_index() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted ASF file, which claims a large "ict" field in the header but does not contain sufficient backing data, is provided, the for loop would consume huge CPU and memory resources, since there is no EOF check inside the loop.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In libavformat/asfdec_f.c in FFmpeg 3.3.3, a DoS in asf_build_simple_index() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted ASF file, which claims a large "ict" field in the header but does not contain sufficient backing data, is provided, the for loop would consume huge CPU and memory resources, since there is no EOF check inside the loop.
- Record
CVE-2017-14223- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 7.1 High
AV:N/AC:M/Au:N/C:N/I:N/A:C - Weakness
- CWE-400
- Updated
- 2026-11-02
CVE List No score
In libavformat/asfdec_f.c in FFmpeg 3.3.3, a DoS in asf_build_simple_index() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted ASF file, which claims a large "ict" field in the header but does not contain sufficient backing data, is provided, the for loop would consume huge CPU and memory resources, since there is no EOF check inside the loop.
- Record
CVE-2017-14223- Updated
- 2026-11-02
EUVDEUVD-2017-5733 No score
In libavformat/asfdec_f.c in FFmpeg 3.3.3, a DoS in asf_build_simple_index() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted ASF file, which claims a large "ict" field in the header but does not contain sufficient backing data, is provided, the for loop would consume huge CPU and memory resources, since there is no EOF check inside the loop.
- Record
EUVD-2017-5733- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fhhh-rhfq-jf53
In libavformat/asfdec_f.c in FFmpeg 3.3.3, a DoS in asf_build_simple_index() due to lack of an...
In libavformat/asfdec_f.c in FFmpeg 3.3.3, a DoS in asf_build_simple_index() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted ASF file, which claims a large "ict" field in the header but does not contain sufficient backing data, is provided, the for loop would consume huge CPU and memory resources, since there is no EOF check inside the loop.
- Record
GHSA-fhhh-rhfq-jf53- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVALPINE-CVE-2017-14223
In libavformat/asfdec_f.c in FFmpeg 3.3.3, a DoS in asf_build_simple_index() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted ASF file, which claims a large "ict" field in the header but does not contain sufficient backing data, is provided, the for loop would consume huge CPU and memory resources, since there is no EOF check inside the loop.
- Record
ALPINE-CVE-2017-14223- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
In libavformat/asfdec_f.c in FFmpeg 3.3.3, a DoS in asf_build_simple_index() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted ASF file, which claims a large "ict" field in the header but does not contain sufficient backing data, is provided, the for loop would consume huge CPU and memory resources, since there is no EOF check inside the loop.
- Record
CVE-2017-14223- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-07
Show 4 moreShow less
OSVDEBIAN-CVE-2017-14223
In libavformat/asfdec_f.c in FFmpeg 3.3.3, a DoS in asf_build_simple_index() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted ASF file, which claims a large "ict" field in the header but does not contain sufficient backing data, is provided, the for loop would consume huge CPU and memory resources, since there is no EOF check inside the loop.
- Record
DEBIAN-CVE-2017-14223- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-14223
In libavformat/asfdec_f.c in FFmpeg 3.3.3, a DoS in asf_build_simple_index() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted ASF file, which claims a large "ict" field in the header but does not contain sufficient backing data, is provided, the for loop would consume huge CPU and memory resources, since there is no EOF check inside the loop.
- Record
UBUNTU-CVE-2017-14223- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2018-0008 No score
Updated ffmpeg packages fix security vulnerability
This update provides ffmpeg version 2.4.14, which fixes several security vulnerabilities and other bugs which were corrected upstream.
- Record
MGASA-2018-0008- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10754-1 No score
ffmpeg-4-4.4-5.2 on GA media
These are all security issues fixed in the ffmpeg-4-4.4-5.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10754-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ffmpegAlpine:v3.4 |
before 3.1.11-r0 | 3.1.11-r0 |
ffmpegAlpine:v3.5 |
before 3.1.11-r0 | 3.1.11-r0 |
ffmpegAlpine:v3.6 |
before 3.2.8-r0 | 3.2.8-r0 |
ffmpegAlpine:v3.7 |
before 3.3.4-r0 | 3.3.4-r0 |
ffmpegDebian:12 |
before 7:3.3.4-1 | 7:3.3.4-1 |
ffmpegDebian:13 |
before 7:3.3.4-1 | 7:3.3.4-1 |
ffmpegDebian:14 |
before 7:3.3.4-1 | 7:3.3.4-1 |
libavDebian:8 From an advisory covering 6 CVEs |
before 6:11.12-1~deb8u5, plus listed versions 6:11.11-1~deb8u16:11.12-1~deb8u16:11.12-1~deb8u26:11.12-1~deb8u36:11.12-1~deb8u4 Show 12 moreShow less6:11.3-16:11.3-1+deb8u16:11.3-26:11.3-36:11.4-16:11.4-1~deb8u16:11.4-26:11.4-2+x32.16:11.6-1~deb8u16:11.7-1~deb8u16:11.8-1~deb8u16:11.9-1~deb8u1 |
6:11.12-1~deb8u5 |
ffmpegDebian:9 From an advisory covering 13 CVEs |
before 7:3.2.8-1~deb9u1, plus listed versions 7:3.2.5-17:3.2.6-17:3.2.7-1~deb9u1 |
7:3.2.8-1~deb9u1 |
ffmpegMageia:5 From an advisory covering 31 CVEs |
before 2.4.14-1.mga5 | 2.4.14-1.mga5 |
ffmpegMageia:5 From an advisory covering 31 CVEs |
before 2.4.14-1.mga5.tainted | 2.4.14-1.mga5.tainted |
ffmpegUbuntu:16.04:LTS |
before 7:2.8.14-0ubuntu0.16.04.1, plus listed versions 7:2.7.2-1build17:2.8.1-1ubuntu17:2.8.2-1ubuntu17:2.8.3-17:2.8.4-1 Show 9 moreShow less7:2.8.4-1ubuntu17:2.8.4-1ubuntu27:2.8.4-1ubuntu37:2.8.4-1ubuntu47:2.8.6-1ubuntu17:2.8.6-1ubuntu27:2.8.8-0ubuntu0.16.04.17:2.8.10-0ubuntu0.16.04.17:2.8.11-0ubuntu0.16.04.1 |
7:2.8.14-0ubuntu0.16.04.1 |
ffmpeg-4openSUSE:Tumbleweed From an advisory covering 46 CVEs |
before 4.4-5.2 | 4.4-5.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-14223 is a medium vulnerability (CVSS 6.5) in Ffmpeg, published September 9, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.54%, the 85th percentile. Fixed in ffmpeg 3.1.11-r0.
References
securityfocus.com/bid/100703
lists.debian.org/debian-lts-announce/2019/02/msg00005.html
github.com/FFmpeg/FFmpeg/commit/afc9c683ed9db01edb357bc8c19edad4282b3a97
debian.org/security/2017/dsa-3996
nvd.nist.gov/vuln/detail/CVE-2017-14223
Show 52 moreShow less
security.alpinelinux.org/vuln/CVE-2017-14223
security-tracker.debian.org/tracker/CVE-2017-14223
advisories.mageia.org/MGASA-2018-0008.html
bugs.mageia.org/show_bug.cgi?id=20757
ubuntu.com/security/CVE-2017-14223
cve.org/CVERecord?id=CVE-2017-14223
suse.com/security/cve/CVE-2015-8216