CVE-2017-14225

The av_color_primaries_name function in libavutil/pixdesc.c in FFmpeg 3.3.3 may return a NULL pointer depending on a value contained in a file, but callers do not anticipate this, as demonstrated by the avcodec_string function in libavcodec/utils.c, leading to a NULL pointer dereference. (It is also conceivable that there is security relevance for a NULL pointer dereference in av_color_primaries_name calls within the ffprobe command-line program.)

• CWE-476

• http://www.debian.org/security/2017/dsa-3996
• http://www.securityfocus.com/bid/100704Third Party Advisory, VDB Entry
• https://github.com/FFmpeg/FFmpeg/commit/837cb4325b712ff1aab531bf41668933f61d75d2Issue Tracking, Patch, Third Party Advisory
• https://lists.ffmpeg.org/pipermail/ffmpeg-devel/2017-August/215198.htmlMailing List, Patch, Vendor Advisory
• http://www.debian.org/security/2017/dsa-3996
• http://www.securityfocus.com/bid/100704Third Party Advisory, VDB Entry
• https://github.com/FFmpeg/FFmpeg/commit/837cb4325b712ff1aab531bf41668933f61d75d2Issue Tracking, Patch, Third Party Advisory
• https://lists.ffmpeg.org/pipermail/ffmpeg-devel/2017-August/215198.htmlMailing List, Patch, Vendor Advisory

Published

Sep 9, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-1421IBM iNotes is vulnerable to cross-site scripting. This vulne…
• CVE-2017-14219XSS (persistent) on the Intelbras Wireless N 150Mbps router …
• CVE-2017-1422IBM MaaS360 DTM all versions up to 3.81 does not perform pro…
• CVE-2017-14222In libavformat/mov.c in FFmpeg 3.3.3, a DoS in read_tfra() d…
• CVE-2017-14223In libavformat/asfdec_f.c in FFmpeg 3.3.3, a DoS in asf_buil…
• CVE-2017-14224A heap-based buffer overflow in WritePCXImage in coders/pcx.…
• CVE-2017-14226WP1StylesListener.cpp, WP5StylesListener.cpp, and WP42Styles…7.5
• CVE-2017-14227In MongoDB libbson 1.7.0, the bson_iter_codewscope function …
• CVE-2017-14228In Netwide Assembler (NASM) 2.14rc0, there is an illegal add…
• CVE-2017-14229There is an infinite loop in the jpc_dec_tileinit function i…
• CVE-2017-1423IBM WebSphere Portal 8.5 and 9.0 exposes backend server URLs…
• CVE-2017-14230In the mboxlist_do_find function in imap/mboxlist.c in Cyrus…