Ffmpeg

ffmpeg

Vendor: Ffmpeg • 480 CVEs

CVEs (480)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2014-4610 1Ffmpeg 1Ffmpeg Nov 21, 2024 Jan 14, 2020 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 Integer overflow in the get_len function in libavutil/lzo.c in FFmpeg before 0.10.14, 1.1.x before 1.1.12, 1.2.x before 1.2.7, 2.0.x before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.4 allows remote attackers to exe...Show more Integer overflow in the get_len function in libavutil/lzo.c in FFmpeg before 0.10.14, 1.1.x before 1.1.12, 1.2.x before 1.2.7, 2.0.x before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.4 allows remote attackers to execute arbitrary code via a crafted Literal Run.Show less
CVE-2019-17542 3Canonical DebianFfmpeg 3Debian Linux FfmpegUbuntu Linux Nov 21, 2024 Oct 14, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 FFmpeg before 4.2 has a heap-based buffer overflow in vqa_decode_chunk because of an out-of-array access in vqa_decode_init in libavcodec/vqavideo.c.
CVE-2019-17539 3Canonical DebianFfmpeg 3Debian Linux FfmpegUbuntu Linux Nov 21, 2024 Oct 14, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 In FFmpeg before 4.2, avcodec_open2 in libavcodec/utils.c allows a NULL pointer dereference and possibly unspecified other impact when there is no valid close function pointer.
CVE-2019-15942 1Ffmpeg 1Ffmpeg Nov 21, 2024 Sep 5, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 FFmpeg through 4.2 has a "Conditional jump or move depends on uninitialised value" issue in h2645_parse because alloc_rbsp_buffer in libavcodec/h2645_parse.c mishandles rbsp_buffer.
CVE-2019-13390 1Ffmpeg 1Ffmpeg Nov 21, 2024 Jul 7, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 In FFmpeg 4.1.3, there is a division by zero at adx_write_trailer in libavformat/rawenc.c.
CVE-2019-13312 1Ffmpeg 1Ffmpeg Nov 21, 2024 Jul 5, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 block_cmp() in libavcodec/zmbvenc.c in FFmpeg 4.1.3 has a heap-based buffer over-read.
CVE-2019-12730 1Ffmpeg 1Ffmpeg Nov 21, 2024 Jun 4, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 aa_read_header in libavformat/aadec.c in FFmpeg before 3.2.14 and 4.x before 4.1.4 does not check for sscanf failure and consequently allows use of uninitialized variables.
CVE-2019-11339 1Ffmpeg 1Ffmpeg Nov 21, 2024 Apr 19, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 The studio profile decoder in libavcodec/mpeg4videodec.c in FFmpeg 4.0 before 4.0.4 and 4.1 before 4.1.2 allows remote attackers to cause a denial of service (out-of-array access) or possibly have unspecified other impac...Show more The studio profile decoder in libavcodec/mpeg4videodec.c in FFmpeg 4.0 before 4.0.4 and 4.1 before 4.1.2 allows remote attackers to cause a denial of service (out-of-array access) or possibly have unspecified other impact via crafted MPEG-4 video data.Show less
CVE-2019-11338 4Canonical DebianFfmpeg+1 more 4Debian Linux FfmpegSuse Package Hub For Suse Linux Enterprise+1 more Nov 21, 2024 Apr 19, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 libavcodec/hevcdec.c in FFmpeg 3.4 and 4.1.2 mishandles detection of duplicate first slices, which allows remote attackers to cause a denial of service (NULL pointer dereference and out-of-array access) or possibly have...Show more libavcodec/hevcdec.c in FFmpeg 3.4 and 4.1.2 mishandles detection of duplicate first slices, which allows remote attackers to cause a denial of service (NULL pointer dereference and out-of-array access) or possibly have unspecified other impact via crafted HEVC data.Show less
CVE-2019-9721 2Canonical Ffmpeg 2Ffmpeg Ubuntu Linux Nov 21, 2024 Mar 12, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 A denial of service in the subtitle decoder in FFmpeg 3.2 and 4.1 allows attackers to hog the CPU via a crafted video file in Matroska format, because handle_open_brace in libavcodec/htmlsubtitles.c has a complex format...Show more A denial of service in the subtitle decoder in FFmpeg 3.2 and 4.1 allows attackers to hog the CPU via a crafted video file in Matroska format, because handle_open_brace in libavcodec/htmlsubtitles.c has a complex format argument to sscanf.Show less
CVE-2019-9718 3Canonical DebianFfmpeg 3Debian Linux FfmpegUbuntu Linux Nov 21, 2024 Mar 12, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 In FFmpeg 3.2 and 4.1, a denial of service in the subtitle decoder allows attackers to hog the CPU via a crafted video file in Matroska format, because ff_htmlmarkup_to_ass in libavcodec/htmlsubtitles.c has a complex for...Show more In FFmpeg 3.2 and 4.1, a denial of service in the subtitle decoder allows attackers to hog the CPU via a crafted video file in Matroska format, because ff_htmlmarkup_to_ass in libavcodec/htmlsubtitles.c has a complex format argument to sscanf.Show less
CVE-2019-1000016 1Ffmpeg 1Ffmpeg Nov 21, 2024 Feb 4, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 FFMPEG version 4.1 contains a CWE-129: Improper Validation of Array Index vulnerability in libavcodec/cbs_av1.c that can result in Denial of service. This attack appears to be exploitable via specially crafted AV1 file h...Show more FFMPEG version 4.1 contains a CWE-129: Improper Validation of Array Index vulnerability in libavcodec/cbs_av1.c that can result in Denial of service. This attack appears to be exploitable via specially crafted AV1 file has to be provided as input. This vulnerability appears to have been fixed in after commit b97a4b658814b2de8b9f2a3bce491c002d34de31.Show less
CVE-2018-15822 3Canonical DebianFfmpeg 3Debian Linux FfmpegUbuntu Linux Nov 21, 2024 Aug 23, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The flv_write_packet function in libavformat/flvenc.c in FFmpeg through 2.8 does not check for an empty audio packet, leading to an assertion failure.
CVE-2018-1999015 1Ffmpeg 1Ffmpeg Nov 21, 2024 Jul 23, 2018 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 FFmpeg before commit 5aba5b89d0b1d73164d3b81764828bb8b20ff32a contains an out of array read vulnerability in ASF_F format demuxer that can result in heap memory reading. This attack appear to be exploitable via specially...Show more FFmpeg before commit 5aba5b89d0b1d73164d3b81764828bb8b20ff32a contains an out of array read vulnerability in ASF_F format demuxer that can result in heap memory reading. This attack appear to be exploitable via specially crafted ASF file that has to provided as input. This vulnerability appears to have been fixed in 5aba5b89d0b1d73164d3b81764828bb8b20ff32a and later.Show less
CVE-2018-1999014 1Ffmpeg 1Ffmpeg Nov 21, 2024 Jul 23, 2018 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 FFmpeg before commit bab0716c7f4793ec42e05a5aa7e80d82a0dd4e75 contains an out of array access vulnerability in MXF format demuxer that can result in DoS. This attack appear to be exploitable via specially crafted MXF fil...Show more FFmpeg before commit bab0716c7f4793ec42e05a5aa7e80d82a0dd4e75 contains an out of array access vulnerability in MXF format demuxer that can result in DoS. This attack appear to be exploitable via specially crafted MXF file which has to be provided as input. This vulnerability appears to have been fixed in bab0716c7f4793ec42e05a5aa7e80d82a0dd4e75 and later.Show less
CVE-2018-1999013 1Ffmpeg 1Ffmpeg Nov 21, 2024 Jul 23, 2018 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 FFmpeg before commit a7e032a277452366771951e29fd0bf2bd5c029f0 contains a use-after-free vulnerability in the realmedia demuxer that can result in vulnerability allows attacker to read heap memory. This attack appear to b...Show more FFmpeg before commit a7e032a277452366771951e29fd0bf2bd5c029f0 contains a use-after-free vulnerability in the realmedia demuxer that can result in vulnerability allows attacker to read heap memory. This attack appear to be exploitable via specially crafted RM file has to be provided as input. This vulnerability appears to have been fixed in a7e032a277452366771951e29fd0bf2bd5c029f0 and later.Show less
CVE-2018-1999012 1Ffmpeg 1Ffmpeg Nov 21, 2024 Jul 23, 2018 N/A· v4 6.5 MEDIUM· v3 7.1 HIGH· v2 FFmpeg before commit 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 contains a CWE-835: Infinite loop vulnerability in pva format demuxer that can result in a Vulnerability that allows attackers to consume excessive amount of...Show more FFmpeg before commit 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 contains a CWE-835: Infinite loop vulnerability in pva format demuxer that can result in a Vulnerability that allows attackers to consume excessive amount of resources like CPU and RAM. This attack appear to be exploitable via specially crafted PVA file has to be provided as input. This vulnerability appears to have been fixed in 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 and later.Show less
CVE-2018-1999011 1Ffmpeg 1Ffmpeg Nov 21, 2024 Jul 23, 2018 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 FFmpeg before commit 2b46ebdbff1d8dec7a3d8ea280a612b91a582869 contains a Buffer Overflow vulnerability in asf_o format demuxer that can result in heap-buffer-overflow that may result in remote code execution. This attack...Show more FFmpeg before commit 2b46ebdbff1d8dec7a3d8ea280a612b91a582869 contains a Buffer Overflow vulnerability in asf_o format demuxer that can result in heap-buffer-overflow that may result in remote code execution. This attack appears to be exploitable via specially crafted ASF file that has to be provided as input to FFmpeg. This vulnerability appears to have been fixed in 2b46ebdbff1d8dec7a3d8ea280a612b91a582869 and later.Show less
CVE-2018-1999010 2Debian Ffmpeg 2Debian Linux Ffmpeg Nov 21, 2024 Jul 23, 2018 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 FFmpeg before commit cced03dd667a5df6df8fd40d8de0bff477ee02e8 contains multiple out of array access vulnerabilities in the mms protocol that can result in attackers accessing out of bound data. This attack appear to be e...Show more FFmpeg before commit cced03dd667a5df6df8fd40d8de0bff477ee02e8 contains multiple out of array access vulnerabilities in the mms protocol that can result in attackers accessing out of bound data. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in cced03dd667a5df6df8fd40d8de0bff477ee02e8 and later.Show less
CVE-2018-14395 2Debian Ffmpeg 2Debian Linux Ffmpeg Nov 21, 2024 Jul 19, 2018 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 libavformat/movenc.c in FFmpeg 3.2 and 4.0.2 allows attackers to cause a denial of service (application crash caused by a divide-by-zero error) with a user crafted audio file when converting to the MOV audio format.

Previous 1...8910...24 Next