CVE-2017-14223

In libavformat/asfdec_f.c in FFmpeg 3.3.3, a DoS in asf_build_simple_index() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted ASF file, which claims a large "ict" field in the header but does not contain sufficient backing data, is provided, the for loop would consume huge CPU and memory resources, since there is no EOF check inside the loop.

• CWE-400

• http://www.debian.org/security/2017/dsa-3996Third Party Advisory
• http://www.securityfocus.com/bid/100703Third Party Advisory, VDB Entry
• https://github.com/FFmpeg/FFmpeg/commit/afc9c683ed9db01edb357bc8c19edad4282b3a97Issue Tracking, Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/02/msg00005.htmlThird Party Advisory
• http://www.debian.org/security/2017/dsa-3996Third Party Advisory
• http://www.securityfocus.com/bid/100703Third Party Advisory, VDB Entry
• https://github.com/FFmpeg/FFmpeg/commit/afc9c683ed9db01edb357bc8c19edad4282b3a97Issue Tracking, Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/02/msg00005.htmlThird Party Advisory

Published

Sep 9, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-14207Rejected reason: Unused CVE for 2017
• CVE-2017-14208Rejected reason: Unused CVE for 2017
• CVE-2017-1421IBM iNotes is vulnerable to cross-site scripting. This vulne…
• CVE-2017-14219XSS (persistent) on the Intelbras Wireless N 150Mbps router …
• CVE-2017-1422IBM MaaS360 DTM all versions up to 3.81 does not perform pro…
• CVE-2017-14222In libavformat/mov.c in FFmpeg 3.3.3, a DoS in read_tfra() d…
• CVE-2017-14224A heap-based buffer overflow in WritePCXImage in coders/pcx.…
• CVE-2017-14225The av_color_primaries_name function in libavutil/pixdesc.c …
• CVE-2017-14226WP1StylesListener.cpp, WP5StylesListener.cpp, and WP42Styles…7.5
• CVE-2017-14227In MongoDB libbson 1.7.0, the bson_iter_codewscope function …
• CVE-2017-14228In Netwide Assembler (NASM) 2.14rc0, there is an illegal add…
• CVE-2017-14229There is an infinite loop in the jpc_dec_tileinit function i…