CVE-2017-13666 An integer underflow vulnerability exists in pixel-a.asm, the x86 assembly code for planeClipAndMax() in MulticoreWare x265 through 2.5, as used in libbpg and other products. A small height value can....
MediumCVSS 5.5
EPSS 0.38%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An integer underflow vulnerability exists in pixel-a.asm, the x86 assembly code for planeClipAndMax() in MulticoreWare x265 through 2.5, as used in libbpg and other products. A small height value can cause an integer underflow, which leads to a crash. This is a different vulnerability than CVE-2017-8906.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| multicorewareinc x265 | = 0.1 | No fix listed |
| multicorewareinc x265 | = 0.2 | No fix listed |
| multicorewareinc x265 | = 0.3 | No fix listed |
| multicorewareinc x265 | = 0.4 | No fix listed |
| multicorewareinc x265 | = 0.4.1 | No fix listed |
| multicorewareinc x265 | = 0.5 | No fix listed |
| multicorewareinc x265 | = 0.6 | No fix listed |
| multicorewareinc x265 | = 0.7 | No fix listed |
| multicorewareinc x265 | = 0.8 | No fix listed |
| multicorewareinc x265 | = 0.9 | No fix listed |
| multicorewareinc x265 | = 1 | No fix listed |
| multicorewareinc x265 | = 1.1 | No fix listed |
| multicorewareinc x265 | = 1.2 | No fix listed |
| multicorewareinc x265 | = 1.3 | No fix listed |
| multicorewareinc x265 | = 1.4 | No fix listed |
| multicorewareinc x265 | = 1.5 | No fix listed |
| multicorewareinc x265 | = 1.6 | No fix listed |
| multicorewareinc x265 | = 1.7 | No fix listed |
| multicorewareinc x265 | = 1.8 | No fix listed |
| multicorewareinc x265 | = 1.9 | No fix listed |
| multicorewareinc x265 | = 2.0 | No fix listed |
| multicorewareinc x265 | = 2.1 | No fix listed |
| multicorewareinc x265 | = 2.2 | No fix listed |
| multicorewareinc x265 | = 2.3 | No fix listed |
| multicorewareinc x265 | = 2.4 | No fix listed |
Show 1 more
| Product | Affected versions | Fixed in |
|---|---|---|
| multicorewareinc x265 | = 2.5 | No fix listed |
References
- bitbucket.org exploit third-party-advisory
- Debian Security Tracker CVE-2017-13666 vendor-advisory