Vulnerabilities > CVE-2017-13666 - Integer Underflow (Wrap or Wraparound) vulnerability in Multicorewareinc X265

CVSS 2.1 - LOW

Attack vector

LOCAL

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

PARTIAL

local

low complexity

multicorewareinc

CWE-191

NVD

Published: 2017-08-24

Updated: 2017-09-07

Summary

An integer underflow vulnerability exists in pixel-a.asm, the x86 assembly code for planeClipAndMax() in MulticoreWare x265 through 2.5, as used in libbpg and other products. A small height value can cause an integer underflow, which leads to a crash. This is a different vulnerability than CVE-2017-8906.

Vulnerable Configurations

Part	Description	Count
Application	Multicorewareinc Multicorewareinc X265 0.1 Multicorewareinc X265 0.2 Multicorewareinc X265 0.3 Multicorewareinc X265 0.4 Multicorewareinc X265 0.4.1 Multicorewareinc X265 0.5 Multicorewareinc X265 0.6 Multicorewareinc X265 0.7 Multicorewareinc X265 0.8 Multicorewareinc X265 0.9 Multicorewareinc X265 1 Multicorewareinc X265 1.1 Multicorewareinc X265 1.2 Multicorewareinc X265 1.3 Multicorewareinc X265 1.4 Multicorewareinc X265 1.5 Multicorewareinc X265 1.6 Multicorewareinc X265 1.7 Multicorewareinc X265 1.8 Multicorewareinc X265 1.9 Multicorewareinc X265 2.0 Multicorewareinc X265 2.1 Multicorewareinc X265 2.2 Multicorewareinc X265 2.3 Multicorewareinc X265 2.4 Multicorewareinc X265 2.5	26

Common Weakness Enumeration (CWE)

CWE-191 - Integer Underflow (Wrap or Wraparound)

References

https://bitbucket.org/multicoreware/x265/issues/364/integer-overflow-and-affect-top-level