CVE-2017-8891

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2017-8891
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-8891.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2017-8891
Downstream
Published
2017-05-10T16:29:00Z
Modified
2025-10-21T04:22:35.454983Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

Dropbox Lepton 1.2.1 allows DoS (SEGV and application crash) via a malformed lepton file because the code does not ensure setup of a correct number of threads.

References

Affected packages

Git / github.com/dropbox/lepton

Affected ranges

Type
GIT
Repo
https://github.com/dropbox/lepton
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
82167c144a322cc956da45407f6dce8d4303d346

Affected versions

1.*

1.0
1.1
1.2
1.2.1

Database specific

vanir_signatures

[
    {
        "signature_version": "v1",
        "deprecated": false,
        "id": "CVE-2017-8891-1d051b62",
        "target": {
            "file": "src/lepton/vp8_decoder.cc"
        },
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "159548571258986322238776647046548753064",
                "39350346401471504086858263354224974567",
                "114249630470462365164529340061812825261",
                "224783973320702116608563977717599054096",
                "318142797505572948893440452073795306824",
                "283798816933924975585219583092774611889",
                "314678254315387458533672861798594793647",
                "321698767621727103834527717197129610850",
                "156412432547229152923612288602553601485",
                "161547218510824082888181917335613079937",
                "100572031566266426414518343941402582425",
                "319860669975468017438043927960077700297",
                "149675271633949007479188669480320749883",
                "37376949316336884606350086861662995833",
                "300697915019048962086643010603185693764"
            ]
        },
        "source": "https://github.com/dropbox/lepton/commit/82167c144a322cc956da45407f6dce8d4303d346"
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "id": "CVE-2017-8891-5e06033f",
        "target": {
            "file": "src/lepton/bitops.hh"
        },
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "314071305879422203352417641333121884808",
                "196255874029856677362052425588051527158",
                "70392186411237790143914193806125212545",
                "193210458976089337072729924769243800356",
                "202664343419612971196904659096093524699",
                "145631498893344382670588488413600828380",
                "207700876068794755845473659853552077646",
                "327937561458595663739959436565596969492",
                "130094591969341488232814562694191730827"
            ]
        },
        "source": "https://github.com/dropbox/lepton/commit/82167c144a322cc956da45407f6dce8d4303d346"
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "id": "CVE-2017-8891-a9ec0620",
        "target": {
            "file": "src/lepton/lepton_codec.cc"
        },
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "166710555843909245683899232161603044173",
                "312730344868618540975331084934583245622",
                "265510303578159240517356456581907607285",
                "322787428952934496016279410108127208837"
            ]
        },
        "source": "https://github.com/dropbox/lepton/commit/82167c144a322cc956da45407f6dce8d4303d346"
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "id": "CVE-2017-8891-b5eae391",
        "target": {
            "function": "bounded_iostream::write_no_buffer",
            "file": "src/lepton/bitops.cc"
        },
        "signature_type": "Function",
        "digest": {
            "length": 716.0,
            "function_hash": "85881905655203848891677532301654687322"
        },
        "source": "https://github.com/dropbox/lepton/commit/82167c144a322cc956da45407f6dce8d4303d346"
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "id": "CVE-2017-8891-e51e0ffa",
        "target": {
            "file": "src/lepton/bitops.cc"
        },
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "324364481743382595350208590128175957652",
                "252784573190285570612371181540055979148",
                "278601953651909222513029664346829420933",
                "89162462976366885035506321050712599647",
                "116354405341811769801040351144643992451",
                "262127703418006626026286982289841872693",
                "45579194772576923245059060269568560786",
                "261732935906384895701009244165015140376"
            ]
        },
        "source": "https://github.com/dropbox/lepton/commit/82167c144a322cc956da45407f6dce8d4303d346"
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "id": "CVE-2017-8891-ee2868d3",
        "target": {
            "file": "src/vp8/decoder/boolreader.hh"
        },
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "97298164820651383507473015866570065381",
                "20179038577639057928886573998262249039",
                "144024260365033646800639789168616278288",
                "98780428089348859496415584629336681321"
            ]
        },
        "source": "https://github.com/dropbox/lepton/commit/82167c144a322cc956da45407f6dce8d4303d346"
    }
]