CVE-2017-0393 — libvpx: Denial of service in mediaserver

Back Back to CVE browser

MEDIUM

libvpx: Denial of service in mediaserver

Published Jan 12, 2017

5.5

MEDIUM

CVSS 3.0

EPSS 0.89%

Description

A denial of service vulnerability in libvpx in Mediaserver could enable a remote attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-30436808.

Affected products

Vendor Google Inc. Product Android Default
n/a
- Version
  Android-4.4.4
  Status
  affected
  Constraints
  -
- Version
  Android-5.0.2
  Status
  affected
  Constraints
  -
- Version
  Android-5.1.1
  Status
  affected
  Constraints
  -
- Version
  Android-6.0
  Status
  affected
  Constraints
  -
- Version
  Android-6.0.1
  Status
  affected
  Constraints
  -
- Version
  Android-7.0
  Status
  affected
  Constraints
  -
- Version
  Android-7.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Google Inc.

Android

n/a

Version	Status	Constraints
Android-4.4.4	affected	-
Android-5.0.2	affected	-
Android-5.1.1	affected	-
Android-6.0	affected	-
Android-6.0.1	affected	-
Android-7.0	affected	-
Android-7.1	affected	-

Red Hat Enterprise Linux 7

libvpx-0:1.3.0-8.el7

Fixed · RHSA-2020:3876
Red Hat Enterprise Linux 6

libvpx

Out of support scope
Red Hat Enterprise Linux 8

libvpx

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 7	libvpx-0:1.3.0-8.el7	Fixed	RHSA-2020:3876
Red Hat Enterprise Linux 6	libvpx	Out of support scope	n/a
Red Hat Enterprise Linux 8	libvpx	Not affected	n/a

Remediation

No remediation recorded yet.

Metrics

0.89% 0.00892

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00892

Score over time

2021–2026

EPSS v1
EPSS v5
EPSS v2
EPSS v3

Percentile over time

EPSS v1
EPSS v5
EPSS v2
EPSS v3

Table of values (9 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.89% (0.00892)	57.96th	v5 (v2026.06.15)
Aug 23, 2026	1.65% (0.01646)	74.25th	v5 (v2026.06.15)
Jul 20, 2024	0.18% (0.00180)	55.60th	v3 (v2023.03.01)
Jan 18, 2024	0.18% (0.00180)	55.32th	v3 (v2023.03.01)
Mar 7, 2023	0.18% (0.00179)	53.29th	v3 (v2023.03.01)
Mar 6, 2023	1.14% (0.01136)	59.45th	v2 (v2022.01.01)
Feb 4, 2022	1.14% (0.01136)	34.23th	v2 (v2022.01.01)
Feb 3, 2022	0.54% (0.00539)	12.60th	v5 (v2026.06.15)
Apr 14, 2021	0.54% (0.00539)	0.00th	v1

Weaknesses (1)

CWE-400

Uncontrolled Resource Consumption

References (7)

http://www.securityfocus.com/bid/95230
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://access.redhat.com/security/cve/CVE-2017-0393
Vendor Advisory
https://android.googlesource.com/platform/external/libvpx/+/6886e8e0a9db2dbad723dc37a548233e004b33bc
x_refsource_CONFIRMIssue TrackingPatch
https://bugzilla.redhat.com/show_bug.cgi?id=1769657
Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2017-0393
https://source.android.com/security/bulletin/2017-01-01.html
x_refsource_CONFIRMVendor Advisory
https://www.cve.org/CVERecord?id=CVE-2017-0393

Link	Providers	Tags
http://www.securityfocus.com/bid/95230		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://access.redhat.com/security/cve/CVE-2017-0393		Vendor Advisory
https://android.googlesource.com/platform/external/libvpx/+/6886e8e0a9db2dbad723dc37a548233e004b33bc		x_refsource_CONFIRMIssue TrackingPatch
https://bugzilla.redhat.com/show_bug.cgi?id=1769657		Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2017-0393
https://source.android.com/security/bulletin/2017-01-01.html		x_refsource_CONFIRMVendor Advisory
https://www.cve.org/CVERecord?id=CVE-2017-0393