CVE-2017-9254 The mp4ff_read_stts function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of service (large loop and CPU consumption) via a craf...
MediumCVSS 5.5
EPSS 0.96%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The mp4ff_read_stts function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of service (large loop and CPU consumption) via a crafted mp4 file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/faad2(Debian:12) | < 2.8.1-1 | 2.8.1-1 |
| debian/faad2(Debian:13) | < 2.8.1-1 | 2.8.1-1 |
| debian/faad2(Debian:14) | < 2.8.1-1 | 2.8.1-1 |
| audiocoding freeware advanced audio decoder 2 | = 2.7 | No fix listed |
References
- Debian Security Tracker CVE-2017-9254 vendor-advisory
- seclists.org mailing-list third-party-advisory
- bugs.debian.org issue-tracking