UBUNTU-CVE-2017-8906
Dashboard / Vulnerabilities / UBUNTU-CVE-2017-8906
Summary:
Details: An integer underflow vulnerability exists in pixel-a.asm, the x86 assembly code for planeClipAndMax() in MulticoreWare x265 through 2.4, as used by the x265_encoder_encode dependency in libbpg and other products. A small picture can cause an integer underflow, which leads to a Denial of Service in the process of encoding.
References: https://ubuntu.com/security/CVE-2017-8906, https://bitbucket.org/multicoreware/x265_git/issues/345/integer-underflow-in-x265-source-common, https://www.cve.org/CVERecord?id=CVE-2017-8906
Affected packages
Package
Name: x265
Purl: pkg:deb/ubuntu/[email protected]~esm1?arch=source&distro=esm-apps/xenial
Affected ranges
Type: ECOSYSTEM
Events:
Introduced- 0
Fixed -None
Affected versions
1.7-4
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
