CVE-2019-14442 — MEDIUM (6.5)

Vulnerability Description

In mpc8_read_header in libavformat/mpc8.c in Libav 12.3, an input file can result in an avio_seek infinite loop and hang, with 100% CPU consumption. Attackers could leverage this vulnerability to cause a denial of service via a crafted file.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Libav	Libav	12.3
Debian	Debian Linux	8.0

Related Weaknesses (CWE)

CWE-835

References

https://bugzilla.libav.org/show_bug.cgi?id=1159ExploitIssue TrackingThird Party Advisory
https://lists.debian.org/debian-lts-announce/2019/09/msg00000.htmlMailing ListThird Party Advisory
https://bugzilla.libav.org/show_bug.cgi?id=1159ExploitIssue TrackingThird Party Advisory
https://lists.debian.org/debian-lts-announce/2019/09/msg00000.htmlMailing ListThird Party Advisory

FAQ

What is CVE-2019-14442?

CVE-2019-14442 is a vulnerability with a CVSS score of 6.5 (MEDIUM). In mpc8_read_header in libavformat/mpc8.c in Libav 12.3, an input file can result in an avio_seek infinite loop and hang, with 100% CPU consumption. Attackers could leverage this vulnerability to caus...

How severe is CVE-2019-14442?

CVE-2019-14442 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2019-14442?

Check the references section above for vendor advisories and patch information. Affected products include: Libav Libav, Debian Debian Linux.