Lucene search

[email protected]CVE-2017-12781

HistoryNov 10, 2017 - 2:29 a.m.

CVE-2017-12781

2017-11-1002:29:17

CWE-476

[email protected]

web.nvd.nist.gov

cve-2017-12781

ebml_buffertoid

libebml2

denial of service

null pointer dereference

application crash

mkv file

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

6.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

32.6%

JSON

The EBML_BufferToID function in ebmlelement.c in libebml2 through 2012-08-26 allows remote attackers to cause a denial of service (Null pointer dereference and application crash) via a crafted mkv file.

Affected configurations

NVD

Node

matroskalibebml2Range≤2012-08-26

matroskamkcleanMatch0.8.9

matroskamkvalidatorMatch0.5.1

CPENameOperatorVersion
matroska:libebml2matroska libebml2le2012-08-26
matroska:mkcleanmatroska mkcleaneq0.8.9
matroska:mkvalidatormatroska mkvalidatoreq0.5.1

CPE	Name	Operator	Version
matroska:libebml2	matroska libebml2	le	2012-08-26
matroska:mkclean	matroska mkclean	eq	0.8.9
matroska:mkvalidator	matroska mkvalidator	eq	0.5.1

References

packetstormsecurity.com/files/144902/mkvalidator-0.5.1-Denial-Of-Service.html

seclists.org/fulldisclosure/2017/Nov/19

github.com/Matroska-Org/foundation-source/issues/24

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

6.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

32.6%

JSON

Related for CVE-2017-12781

ubuntucve1 osv1 cvelist1 prion1 nvd1