FF
Product
FFmpeg
533
CVEs
0
On KEV
9.8
Max CVSS
9
New 30D
Severity mix
Critical 30High 145Medium 146Low 3
Watch
Add FFmpeg to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2014-9319 | – | Dec 9 | The ff_hevc_decode_nal_sps function in libavcodec/hevc_ps.c in FFMpeg before 2.1.6, 2.2.x through 2.3.x, and 2.4.x before 2.4.4 allows remote attackers to cause a denial of… Affected: through 2.1.5; 2.2; 2.2.4; 2.3; 2.3.2; 2.3.3; +6 more |
| CVE-2014-9318 | – | Dec 9 | The raw_decode function in libavcodec/rawdec.c in FFMpeg before 2.1.6, 2.2.x through 2.3.x, and 2.4.x before 2.4.4 allows remote attackers to cause a denial of service… Affected: through 2.1.5; 2.2; 2.2.4; 2.3; 2.3.2; 2.3.3; +6 more |
| CVE-2014-9317 | – | Dec 9 | The decode_ihdr_chunk function in libavcodec/pngdec.c in FFMpeg before 2.1.6, 2.2.x through 2.3.x, and 2.4.x before 2.4.4 allows remote attackers to cause a denial of service… Affected: through 2.1.5; 2.2; 2.2.4; 2.3; 2.3.2; 2.3.3; +6 more |
| CVE-2014-9316 | – | Dec 9 | The mjpeg_decode_app function in libavcodec/mjpegdec.c in FFMpeg before 2.1.6, 2.2.x through 2.3.x, and 2.4.x before 2.4.4 allows remote attackers to cause a denial of service… Affected: through 2.1.5; 2.2; 2.2.4; 2.3; 2.3.2; 2.3.3; +6 more |
| CVE-2014-8549 | – | Nov 5 | libavcodec/on2avc.c in FFmpeg before 2.4.2 does not constrain the number of channels to at most 2, which allows remote attackers to cause a denial of service (out-of-bounds… Affected: through 2.4.1; 0.3; 0.3.1; 0.3.2; 0.3.3; 0.3.4; +34 more |
| CVE-2014-8548 | – | Nov 5 | Off-by-one error in libavcodec/smc.c in FFmpeg before 2.4.2 allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact… Affected: through 2.4.1; 0.3; 0.3.1; 0.3.2; 0.3.3; 0.3.4; +34 more |
| CVE-2014-8547 | – | Nov 5 | libavcodec/gifdec.c in FFmpeg before 2.4.2 does not properly compute image heights, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly… Affected: through 2.4.1; 0.3; 0.3.1; 0.3.2; 0.3.3; 0.3.4; +34 more |
| CVE-2014-8546 | – | Nov 5 | Integer underflow in libavcodec/cinepak.c in FFmpeg before 2.4.2 allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other… Affected: through 2.4.1; 0.3; 0.3.1; 0.3.2; 0.3.3; 0.3.4; +34 more |
| CVE-2014-8545 | – | Nov 5 | libavcodec/pngdec.c in FFmpeg before 2.4.2 accepts the monochrome-black format without verifying that the bits-per-pixel value is 1, which allows remote attackers to cause a… Affected: through 2.4.1; 0.3; 0.3.1; 0.3.2; 0.3.3; 0.3.4; +34 more |
| CVE-2014-8544 | – | Nov 5 | libavcodec/tiff.c in FFmpeg before 2.4.2 does not properly validate bits-per-pixel fields, which allows remote attackers to cause a denial of service (out-of-bounds access) or… Affected: through 2.4.1; 0.3; 0.3.1; 0.3.2; 0.3.3; 0.3.4; +34 more |
| CVE-2014-8543 | – | Nov 5 | libavcodec/mmvideo.c in FFmpeg before 2.4.2 does not consider all lines of HHV Intra blocks during validation of image height, which allows remote attackers to cause a denial of… Affected: through 2.4.1; 0.3; 0.3.1; 0.3.2; 0.3.3; 0.3.4; +34 more |
| CVE-2014-8542 | – | Nov 5 | libavcodec/utils.c in FFmpeg before 2.4.2 omits a certain codec ID during enforcement of alignment, which allows remote attackers to cause a denial of service (out-of-bounds… Affected: through 2.4.1 |
| CVE-2014-8541 | – | Nov 5 | libavcodec/mjpegdec.c in FFmpeg before 2.4.2 considers only dimension differences, and not bits-per-pixel differences, when determining whether an image size has changed, which… Affected: through 2.4.1; 0.3; 0.3.1; 0.3.2; 0.3.3; 0.3.4; +34 more |
| CVE-2014-5272 | – | Nov 3 | libavcodec/iff.c in FFMpeg before 1.1.14, 1.2.x before 1.2.8, 2.2.x before 2.2.7, and 2.3.x before 2.3.2 allows remote attackers to have unspecified impact via a crafted iff… Affected: through 1.1.13; 1.1; 1.1.1; 1.1.2; 1.1.3; 1.1.4; +31 more |
| CVE-2014-5271 | – | Nov 3 | Heap-based buffer overflow in the encode_slice function in libavcodec/proresenc_kostya.c in FFMpeg before 1.1.14, 1.2.x before 1.2.8, 2.x before 2.2.7, and 2.3.x before 2.3.3 and… Affected: through 1.1.13; 1.1; 1.1.1; 1.1.2; 1.1.3; 1.1.4; +31 more |
| CVE-2014-2099 | – | Mar 2 | The msrle_decode_frame function in libavcodec/msrle.c in FFmpeg before 2.1.4 does not properly calculate line sizes, which allows remote attackers to cause a denial of service… Affected: through 2.1.3; 2.0; 2.0.1; 2.0.2; 2.0.3; 2.1; +2 more |
| CVE-2014-2098 | – | Mar 2 | libavcodec/wmalosslessdec.c in FFmpeg before 2.1.4 uses an incorrect data-structure size for certain coefficients, which allows remote attackers to cause a denial of service… Affected: through 2.1.3; 2.0; 2.0.1; 2.0.2; 2.0.3; 2.1; +2 more |
| CVE-2014-2097 | – | Mar 2 | The tak_decode_frame function in libavcodec/takdec.c in FFmpeg before 2.1.4 does not properly validate a certain bits-per-sample value, which allows remote attackers to cause a… Affected: through 2.1.3; 2.0; 2.0.1; 2.0.2; 2.0.3; 2.1; +2 more |
| CVE-2014-2263 | – | Mar 1 | The mpegts_write_pmt function in the MPEG2 transport stream (aka DVB) muxer (libavformat/mpegtsenc.c) in FFmpeg, possibly 2.1 and earlier, allows remote attackers to have… Affected: through 2.1; 2.0; 2.0.1; 2.0.2; 2.0.3 |
| CVE-2012-6618 | – | Dec 24 | The av_probe_input_buffer function in libavformat/utils.c in FFmpeg before 1.0.2, when running with certain -probesize values, allows remote attackers to cause a denial of service… Affected: through 1.0.1; 1.0 |
| CVE-2012-6617 | – | Dec 24 | The prepare_sdp_description function in ffserver.c in FFmpeg before 1.0.2 allows remote attackers to cause a denial of service (crash) via vectors related to the rtp format Affected: through 1.0.1; 1.0 |
| CVE-2012-6616 | – | Dec 24 | The mov_text_decode_frame function in libavcodec/movtextdec.c in FFmpeg before 1.0.2 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via… Affected: through 1.0.1; 1.0 |
| CVE-2012-6615 | – | Dec 24 | The ff_ass_split_override_codes function in libavcodec/ass_split.c in FFmpeg before 1.0.2 allows remote attackers to cause a denial of service (NULL pointer dereference and crash)… Affected: through 1.0.1; 1.0 |
| CVE-2013-4358 | – | Dec 24 | libavcodec/h264.c in FFmpeg before 0.11.4 allows remote attackers to cause a denial of service (crash) via vectors related to alternating bit depths in H.264 data Affected: through 0.11.3; 0.11; 0.11.1; 0.11.2 |
| CVE-2013-7024 | – | Dec 9 | The jpeg2000_decode_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.1 does not consider the component number in certain calculations, which allows remote attackers to… Affected: through 2.0.1; 0.3; 0.3.1; 0.3.2; 0.3.3; 0.3.4; +34 more |
| CVE-2013-7023 | – | Dec 9 | The ff_combine_frame function in libavcodec/parser.c in FFmpeg before 2.1 does not properly handle certain memory-allocation errors, which allows remote attackers to cause a… Affected: through 2.0.1; 0.3; 0.3.1; 0.3.2; 0.3.3; 0.3.4; +34 more |
| CVE-2013-7022 | – | Dec 9 | The g2m_init_buffers function in libavcodec/g2meet.c in FFmpeg before 2.1 does not properly allocate memory for tiles, which allows remote attackers to cause a denial of service… Affected: through 2.0.1; 0.3; 0.3.1; 0.3.2; 0.3.3; 0.3.4; +34 more |
| CVE-2013-7021 | – | Dec 9 | The filter_frame function in libavfilter/vf_fps.c in FFmpeg before 2.1 does not properly ensure the availability of FIFO content, which allows remote attackers to cause a denial… Affected: through 2.0.1; 0.3; 0.3.1; 0.3.2; 0.3.3; 0.3.4; +34 more |
| CVE-2013-7020 | – | Dec 9 | The read_header function in libavcodec/ffv1dec.c in FFmpeg before 2.1 does not properly enforce certain bit-count and colorspace constraints, which allows remote attackers to… Affected: through 2.0.1; 0.3; 0.3.1; 0.3.2; 0.3.3; 0.3.4; +34 more |
| CVE-2013-7019 | – | Dec 9 | The get_cox function in libavcodec/jpeg2000dec.c in FFmpeg before 2.1 does not properly validate the reduction factor, which allows remote attackers to cause a denial of service… Affected: through 2.0.1; 0.3; 0.3.1; 0.3.2; 0.3.3; 0.3.4; +34 more |
| CVE-2013-7018 | – | Dec 9 | libavcodec/jpeg2000dec.c in FFmpeg before 2.1 does not ensure the use of valid code-block dimension values, which allows remote attackers to cause a denial of service… Affected: through 2.0.1; 0.3; 0.3.1; 0.3.2; 0.3.3; 0.3.4; +34 more |
| CVE-2013-7017 | – | Dec 9 | libavcodec/jpeg2000.c in FFmpeg before 2.1 allows remote attackers to cause a denial of service (invalid pointer dereference) or possibly have unspecified other impact via crafted… Affected: through 2.0.1; 0.3; 0.3.1; 0.3.2; 0.3.3; 0.3.4; +34 more |
| CVE-2013-7016 | – | Dec 9 | The get_siz function in libavcodec/jpeg2000dec.c in FFmpeg before 2.1 does not ensure the expected sample separation, which allows remote attackers to cause a denial of service… Affected: through 2.0.1; 0.3; 0.3.1; 0.3.2; 0.3.3; 0.3.4; +34 more |
| CVE-2013-7015 | – | Dec 9 | The flashsv_decode_frame function in libavcodec/flashsv.c in FFmpeg before 2.1 does not properly validate a certain height value, which allows remote attackers to cause a denial… Affected: through 2.0.1; 0.3; 0.3.1; 0.3.2; 0.3.3; 0.3.4; +34 more |
| CVE-2013-7014 | – | Dec 9 | Integer signedness error in the add_bytes_l2_c function in libavcodec/pngdsp.c in FFmpeg before 2.1 allows remote attackers to cause a denial of service (out-of-bounds array… Affected: through 2.0.1; 0.3; 0.3.1; 0.3.2; 0.3.3; 0.3.4; +34 more |
| CVE-2013-7013 | – | Dec 9 | The g2m_init_buffers function in libavcodec/g2meet.c in FFmpeg before 2.1 uses an incorrect ordering of arithmetic operations, which allows remote attackers to cause a denial of… Affected: through 2.0.1; 0.3; 0.3.1; 0.3.2; 0.3.3; 0.3.4; +34 more |
| CVE-2013-7012 | – | Dec 9 | The get_siz function in libavcodec/jpeg2000dec.c in FFmpeg before 2.1 does not prevent attempts to use non-zero image offsets, which allows remote attackers to cause a denial of… Affected: through 2.0.1; 0.3; 0.3.1; 0.3.2; 0.3.3; 0.3.4; +34 more |
| CVE-2013-7011 | – | Dec 9 | The read_header function in libavcodec/ffv1dec.c in FFmpeg before 2.1 does not prevent changes to global parameters, which allows remote attackers to cause a denial of service… Affected: through 2.0.1; 0.3; 0.3.1; 0.3.2; 0.3.3; 0.3.4; +34 more |
| CVE-2013-7010 | – | Dec 9 | Multiple integer signedness errors in libavcodec/dsputil.c in FFmpeg before 2.1 allow remote attackers to cause a denial of service (out-of-bounds array access) or possibly have… Affected: through 2.0.1; 0.3; 0.3.1; 0.3.2; 0.3.3; 0.3.4; +34 more |
| CVE-2013-7009 | – | Dec 9 | The rpza_decode_stream function in libavcodec/rpza.c in FFmpeg before 2.1 does not properly maintain a pointer to pixel data, which allows remote attackers to cause a denial of… Affected: through 2.0.1; 0.3; 0.3.1; 0.3.2; 0.3.3; 0.3.4; +34 more |
| CVE-2013-7008 | – | Dec 9 | The decode_slice_header function in libavcodec/h264.c in FFmpeg before 2.1 incorrectly relies on a certain droppable field, which allows remote attackers to cause a denial of… Affected: through 2.0.1; 0.3; 0.3.1; 0.3.2; 0.3.3; 0.3.4; +34 more |
| CVE-2011-4351 | – | Dec 9 | Buffer overflow in FFmpeg before 0.5.6, 0.6.x before 0.6.4, 0.7.x before 0.7.8, and 0.8.x before 0.8.8 allows remote attackers to execute arbitrary code via unspecified vectors Affected: through 0.5.5; 0.3; 0.3.1; 0.3.2; 0.3.3; 0.3.4; +34 more |
| CVE-2011-3950 | – | Dec 9 | The dirac_decode_data_unit function in libavcodec/diracdec.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact via a crafted value in the reference… Affected: through 0.9.1; 0.3; 0.3.1; 0.3.2; 0.3.3; 0.3.4; +34 more |
| CVE-2011-3949 | – | Dec 9 | The dirac_unpack_idwt_params function in libavcodec/diracdec.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact via crafted Dirac data Affected: through 0.9.1; 0.3; 0.3.1; 0.3.2; 0.3.3; 0.3.4; +34 more |
| CVE-2011-3946 | – | Dec 9 | The ff_h264_decode_sei function in libavcodec/h264_sei.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact via crafted Supplemental enhancement… Affected: through 0.9.1; 0.3; 0.3.1; 0.3.2; 0.3.3; 0.3.4; +34 more |
| CVE-2011-3944 | – | Dec 9 | The smacker_decode_header_tree function in libavcodec/smacker.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact via crafted Smacker data Affected: through 0.9.1; 0.3; 0.3.1; 0.3.2; 0.3.3; 0.3.4; +34 more |
| CVE-2011-3941 | – | Dec 9 | The decode_mb function in libavcodec/error_resilience.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact via vectors related to an uninitialized block… Affected: through 0.9.1; 0.3; 0.3.1; 0.3.2; 0.3.3; 0.3.4; +34 more |
| CVE-2011-3935 | – | Dec 9 | The codec_get_buffer function in ffmpeg.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact via vectors related to a crafted image size Affected: through 0.9.1; 0.3; 0.3.1; 0.3.2; 0.3.3; 0.3.4; +34 more |
| CVE-2011-3934 | – | Dec 9 | Double free vulnerability in the vp3_update_thread_context function in libavcodec/vp3.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact via crafted vp3… Affected: through 0.9.1; 0.3; 0.3.1; 0.3.2; 0.3.3; 0.3.4; +34 more |
| CVE-2013-0859 | – | Dec 7 | The add_doubles_metadata function in libavcodec/tiff.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via a negative or zero count value in a TIFF… Affected: through 1.0; 0.3; 0.3.1; 0.3.2; 0.3.3; 0.3.4; +34 more |
The 500 most important CVEs for this product (exploited first, then by severity)