CVE-2017-14170

In libavformat/mxfdec.c in FFmpeg 3.3.3 -> 2.4, a DoS in mxf_read_index_entry_array() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted MXF file, which claims a large "nb_index_entries" field in the header but does not contain sufficient backing data, is provided, the loop would consume huge CPU resources, since there is no EOF check inside the loop. Moreover, this big loop can be invoked multiple times if there is more than one applicable data segment in the crafted MXF file.

• CWE-834

• http://www.debian.org/security/2017/dsa-3996
• http://www.securityfocus.com/bid/100700
• https://github.com/FFmpeg/FFmpeg/commit/900f39692ca0337a98a7cf047e4e2611071810c2Issue Tracking, Patch, Third Party Advisory
• https://github.com/FFmpeg/FFmpeg/commit/f173cdfe669556aa92857adafe60cbe5f2aa1210
• https://lists.debian.org/debian-lts-announce/2019/01/msg00006.html
• http://www.debian.org/security/2017/dsa-3996
• http://www.securityfocus.com/bid/100700
• https://github.com/FFmpeg/FFmpeg/commit/900f39692ca0337a98a7cf047e4e2611071810c2Issue Tracking, Patch, Third Party Advisory
• https://github.com/FFmpeg/FFmpeg/commit/f173cdfe669556aa92857adafe60cbe5f2aa1210
• https://lists.debian.org/debian-lts-announce/2019/01/msg00006.html

Published

Sep 7, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-14163An issue was discovered in Mahara before 15.04.14, 16.x befo…
• CVE-2017-14164A size-validation issue was discovered in opj_j2k_write_sot …8.8
• CVE-2017-14165The ReadSUNImage function in coders/sun.c in GraphicsMagick …
• CVE-2017-14166libarchive 3.3.2 allows remote attackers to cause a denial o…
• CVE-2017-14167Integer overflow in the load_multiboot function in hw/i386/m…8.8
• CVE-2017-14169In the mxf_read_primer_pack function in libavformat/mxfdec.c…
• CVE-2017-14171In libavformat/nsvdec.c in FFmpeg 2.4 and 3.3.3, a DoS in ns…
• CVE-2017-14172In coders/ps.c in ImageMagick 7.0.7-0 Q16, a DoS in ReadPSIm…6.5
• CVE-2017-14173In the function ReadTXTImage() in coders/txt.c in ImageMagic…6.5
• CVE-2017-14174In coders/psd.c in ImageMagick 7.0.7-0 Q16, a DoS in ReadPSD…6.5
• CVE-2017-14175In coders/xbm.c in ImageMagick 7.0.6-1 Q16, a DoS in ReadXBM…6.5
• CVE-2017-14176Bazaar through 2.7.0, when Subprocess SSH is used, allows re…