CVE-2017-14225: ffmpeg NULL Pointer Dereference
Vulnerability summary
CVE-2017-14225 is a high (CVSS 8.8) NULL Pointer Dereference vulnerability in ffmpeg. EPSS estimates a 2.57% chance of exploitation in the next 30 days, higher than 84.8% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 2 · Related 1Timeline
- 09-09-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
The av_color_primaries_name function in libavutil/pixdesc.c in FFmpeg 3.3.3 may return a NULL pointer depending on a value contained in a file, but callers do not anticipate this, as demonstrated by the avcodec_string function in libavcodec/utils.c, leading to a NULL pointer dereference. (It is also conceivable that there is security relevance for a NULL pointer dereference in av_color_primaries_name calls within the ffprobe command-line program.)
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
2.57%
Chance of exploitation in the next 30 days
Percentile
85%
Versus all other CVEs
30-day change
0.00 pp
From 2.57% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Alpine1 product
- ffmpeg< 3.1.11-r0 | < 3.2.8-r0 | < 3.3.4-r0
Debian1 product
- ffmpeg< 7:3.3.4-1
Ffmpeg1 product
- ffmpegEOL3.3.3
Ubuntu1 product
- ffmpeg< 7:2.8.14-0ubuntu0.16.04.1
4 vendors · 4 products
References
8 links- github.com/FFmpeg/FFmpeg/commit/837cb4325b712ff1aab531bf41668933f61d75d2X Refsource MISCIssue TrackingPatchThird Party AdvisoryREPORT
- lists.ffmpeg.org/pipermail/ffmpeg-devel/2017-August/215198.htmlX Refsource MISCMailing ListPatchVendor Advisory
