{"id":"CVE-2017-14058","details":"In FFmpeg 2.4 and 3.3.3, the read_data function in libavformat/hls.c does not restrict reload attempts for an insufficient list, which allows remote attackers to cause a denial of service (infinite loop).","modified":"2026-08-17T05:25:55.526218Z","published":"2017-08-31T15:29:00.450Z","related":["openSUSE-SU-2024:10754-1"],"references":[{"type":"WEB","url":"http://www.securityfocus.com/bid/100629"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2019/03/msg00041.html"},{"type":"ADVISORY","url":"http://www.debian.org/security/2017/dsa-3996"},{"type":"FIX","url":"https://github.com/FFmpeg/FFmpeg/commit/7ba100d3e6e8b1e5d5342feb960a7f081d6e15af"},{"type":"FIX","url":"https://github.com/FFmpeg/FFmpeg/commit/7ec414892ddcad88313848494b6fc5f437c9ca4a"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.ffmpeg.org/ffmpeg.git","events":[{"introduced":"9079c70d2095643af6954001d0627445650b85a6"},{"last_affected":"9079c70d2095643af6954001d0627445650b85a6"}],"database_specific":{"cpe":"cpe:2.3:a:ffmpeg:ffmpeg:3.3.3:*:*:*:*:*:*:*","extracted_events":[{"introduced":"3.3.3"},{"last_affected":"3.3.3"}],"source":"CPE_STRING"}}],"versions":["3.3.3","n3.3.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-14058.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/ffmpeg/ffmpeg","events":[{"introduced":"9079c70d2095643af6954001d0627445650b85a6"},{"last_affected":"9079c70d2095643af6954001d0627445650b85a6"},{"fixed":"7ba100d3e6e8b1e5d5342feb960a7f081d6e15af"},{"fixed":"7ec414892ddcad88313848494b6fc5f437c9ca4a"}],"database_specific":{"cpe":"cpe:2.3:a:ffmpeg:ffmpeg:3.3.3:*:*:*:*:*:*:*","extracted_events":[{"introduced":"3.3.3"},{"last_affected":"3.3.3"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["3.3.3","n3.3.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-14058.json","vanir_signatures_modified":"2026-08-17T05:25:55Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"307616992488961155689353451593472058202","length":2424},"id":"CVE-2017-14058-00bfb969","signature_type":"Function","signature_version":"v1","source":"https://github.com/ffmpeg/ffmpeg/commit/7ec414892ddcad88313848494b6fc5f437c9ca4a","target":{"file":"libavformat/hls.c","function":"read_data"}},{"target":{"file":"libavformat/hls.c"},"deprecated":false,"digest":{"line_hashes":["304165080079877529652181346720074499131","162067093324696288953250956199808354876","14741327823679758051667399565703620663","103528835990820388798780638136162256474","212210046328153511575685196694234427974","176073871505549656761287110408664618383","30391042795318001125261069865418981873","313142887063955675613583277320037644203","199790939807906335678849154372936472953","65697736203760585144547338555385364426","137674149634999590985749251598179956159","224622235900015262281358376059801374555","12386283591187879730390212292236685420","199246036475103184441872826726779780060","115262420892497008388419261859858552489","140305884192726122940432131855497107686"],"threshold":0.9},"id":"CVE-2017-14058-2210bb97","signature_type":"Line","signature_version":"v1","source":"https://github.com/ffmpeg/ffmpeg/commit/7ba100d3e6e8b1e5d5342feb960a7f081d6e15af"},{"deprecated":false,"digest":{"function_hash":"321259516116468729858418046728872710930","length":2068},"id":"CVE-2017-14058-22cc831c","signature_type":"Function","signature_version":"v1","source":"https://github.com/ffmpeg/ffmpeg/commit/7ba100d3e6e8b1e5d5342feb960a7f081d6e15af","target":{"file":"libavformat/hls.c","function":"read_data"}},{"deprecated":false,"digest":{"line_hashes":["188304760659666760334610689520730816561","276758316171052682441557897754958225397","63791673241347399776134849094345201559","103528835990820388798780638136162256474","212210046328153511575685196694234427974","176073871505549656761287110408664618383","30391042795318001125261069865418981873","313142887063955675613583277320037644203","199790939807906335678849154372936472953","65697736203760585144547338555385364426","60806949653493904052568925773388884442","6971350420336912076190345485067875612","12386283591187879730390212292236685420","199246036475103184441872826726779780060","115262420892497008388419261859858552489","140305884192726122940432131855497107686"],"threshold":0.9},"id":"CVE-2017-14058-3227b939","signature_type":"Line","signature_version":"v1","source":"https://github.com/ffmpeg/ffmpeg/commit/7ec414892ddcad88313848494b6fc5f437c9ca4a","target":{"file":"libavformat/hls.c"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}]}