CVE-2017-11549
CVE-2017-11549 is a medium-severity vulnerability in Timidity++ Project Timidity++ with a CVSS 3.x base score of 5.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-834.
Key facts
- Severity: Medium (CVSS 3.x base score 5.5)
- CVSS v2: 7.1
- EPSS exploit prediction: 1% (57th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-834
- Affected product: Timidity++ Project Timidity++
- Published:
- Last modified:
Description
The play_midi function in playmidi.c in TiMidity++ 2.14.0 allows remote attackers to cause a denial of service (large loop and CPU consumption) via a crafted mid file. NOTE: CPU consumption might be relevant when using the --background option.
Frequently asked questions
- What is CVE-2017-11549?
- The play_midi function in playmidi.c in TiMidity++ 2.14.0 allows remote attackers to cause a denial of service (large loop and CPU consumption) via a crafted mid file. NOTE: CPU consumption might be relevant when using the --background option.
- How severe is CVE-2017-11549?
- CVE-2017-11549 has a CVSS 3.x base score of 5.5, rated medium severity. It is exploitable over local access with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity none, and availability high.
- Is CVE-2017-11549 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (57th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2017-11549?
- CVE-2017-11549 affects Timidity++ Project Timidity++. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2017-11549?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2017-11549 published?
- CVE-2017-11549 was published on 2017-07-31 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:timidity\+\+_project:timidity\+\+:2.14.0:*:*:*:*:*:*:*
More vulnerabilities in Timidity++ Project Timidity++
- CVE-2017-11547 — Medium (CVSS 5.5): The resample_gauss function in resample.c in TiMidity++ 2.14.0 allows remote attackers to cause a denial of service…
- CVE-2017-11546 — Medium (CVSS 5.5): The insert_note_steps function in readmidi.c in TiMidity++ 2.14.0 allows remote attackers to cause a denial of service…
All CVEs affecting Timidity++ Project Timidity++ →
Other CWE-834 (Excessive Iteration) vulnerabilities
- CVE-2017-12587 — High (CVSS 8.8): ImageMagick 7.0.6-1 has a large loop vulnerability in the ReadPWPImage function in coders\pwp.c.
- CVE-2025-62707 — High (CVSS 7.5): pypdf is a free and open-source pure-python PDF library. Prior to version 6.1.3, an attacker who uses this…
- CVE-2025-56571 — High (CVSS 7.5): Finance.js v4.1.0 contains a Denial of Service (DoS) vulnerability via the IRR function’s depth parameter. Improper…
- CVE-2024-4227 — High (CVSS 7.5): In Genivia gSOAP with a specific configuration an unauthenticated remote attacker can generate a high CPU load when…
- CVE-2023-49316 — High (CVSS 7.5): In Math/BinaryField.php in phpseclib 3 before 3.0.34, excessively large degrees can lead to a denial of service.
- CVE-2023-5632 — High (CVSS 7.5): In Eclipse Mosquito before and including 2.0.5, establishing a connection to the mosquitto server without sending data…