This CPE summary could be partial or incomplete. Please contact us for a detailed listing.

Summary

Detail
Vendor Ffmpeg First view 2013-11-23
Product Ffmpeg Last view 2024-08-12
Version 1.2.4 Type Application
Update *  
Edition *  
Language *  
Sofware Edition *  
Target Software *  
Target Hardware *  
Other *  
 
CPE Product cpe:2.3:a:ffmpeg:ffmpeg

Activity : Overall

Related : CVE

This CPE have more than 25 Relations. If you want to see a complete summary for this CPE, please contact us.
  Date Alert Description
8.8 2024-08-12 CVE-2024-7272

A vulnerability, which was classified as critical, was found in FFmpeg up to 5.1.5. This affects the function fill_audiodata of the file /libswresample/swresample.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. This issue was fixed in version 6.0 by 9903ba28c28ab18dc7b7b6fb8571cc8b5caae1a6 but a backport for 5.1 was forgotten. The exploit has been disclosed to the public and may be used. Upgrading to version 5.1.6 and 6.0 9903ba28c28ab18dc7b7b6fb8571cc8b5caae1a6 is able to address this issue. It is recommended to upgrade the affected component.

9.8 2024-01-27 CVE-2024-22862

Integer overflow vulnerability in FFmpeg before n6.1, allows remote attackers to execute arbitrary code via the JJPEG XL Parser.

7.5 2024-01-27 CVE-2024-22861

Integer overflow vulnerability in FFmpeg before n6.1, allows attackers to cause a denial of service (DoS) via the avcodec/osq module.

9.8 2024-01-27 CVE-2024-22860

Integer overflow vulnerability in FFmpeg before n6.1, allows remote attackers to execute arbitrary code via the jpegxl_anim_read_packet component in the JPEG XL Animation decoder.

7.8 2023-11-16 CVE-2023-47470

Buffer Overflow vulnerability in Ffmpeg before github commit 4565747056a11356210ed8edcecb920105e40b60 allows a remote attacker to achieve an out-of-array write, execute arbitrary code, and cause a denial of service (DoS) via the ref_pic_list_struct function in libavcodec/evc_ps.c

5.5 2023-10-27 CVE-2023-46407

FFmpeg prior to commit bf814 was discovered to contain an out of bounds read via the dist->alphabet_size variable in the read_vlc_prefix() function.

8.1 2023-03-29 CVE-2022-48434

libavcodec/pthread_frame.c in FFmpeg before 5.1.2, as used in VLC and other products, leaves stale hwaccel state in worker threads, which allows attackers to trigger a use-after-free and execute arbitrary code in some circumstances (e.g., hardware re-initialization upon a mid-video SPS change when Direct3D11 is used).

5.3 2023-01-12 CVE-2022-3341

A null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of libavformat/nutdec.c file. The flaw occurs because the function lacks check of the return value of avformat_new_stream() and triggers the null pointer dereference error, causing an application to crash.

7.5 2022-12-16 CVE-2022-3109

An issue was discovered in the FFmpeg package, where vp3_decode_frame in libavcodec/vp3.c lacks check of the return value of av_malloc() and will cause a null pointer dereference, impacting availability.

8.1 2022-11-13 CVE-2022-3965

A vulnerability classified as problematic was found in ffmpeg. This vulnerability affects the function smc_encode_stream of the file libavcodec/smcenc.c of the component QuickTime Graphics Video Encoder. The manipulation of the argument y_size leads to out-of-bounds read. The attack can be initiated remotely. The name of the patch is 13c13109759090b7f7182480d075e13b36ed8edd. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-213544.

8.1 2022-11-13 CVE-2022-3964

A vulnerability classified as problematic has been found in ffmpeg. This affects an unknown part of the file libavcodec/rpzaenc.c of the component QuickTime RPZA Video Encoder. The manipulation of the argument y_size leads to out-of-bounds read. It is possible to initiate the attack remotely. The name of the patch is 92f9b28ed84a77138105475beba16c146bdaf984. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-213543.

5.5 2022-05-02 CVE-2022-1475

An integer overflow vulnerability was found in FFmpeg versions before 4.4.2 and before 5.0.1 in g729_parse() in llibavcodec/g729_parser.c when processing a specially crafted file.

7.5 2021-08-12 CVE-2021-38291

FFmpeg version (git commit de8e6e67e7523e48bb27ac224a0b446df05e1640) suffers from a an assertion failure at src/libavutil/mathematics.c.

5.5 2021-08-05 CVE-2021-3566

Prior to ffmpeg version 4.3, the tty demuxer did not have a 'read_probe' function assigned to it. By crafting a legitimate "ffconcat" file that references an image, followed by a file the triggers the tty demuxer, the contents of the second file will be copied into the output file verbatim (as long as the `-vcodec copy` option is passed to ffmpeg).

7.5 2021-01-04 CVE-2020-35965

decode_frame in libavcodec/exr.c in FFmpeg 4.3.1 has an out-of-bounds write because of errors in calculations of when to perform memset zero operations.

8.8 2020-06-16 CVE-2020-14212

FFmpeg through 4.3 has a heap-based buffer overflow in avio_get_str in libavformat/aviobuf.c because dnn_backend_native.c calls ff_dnn_load_model_native and a certain index check is omitted.

8.8 2020-01-14 CVE-2014-4610

Integer overflow in the get_len function in libavutil/lzo.c in FFmpeg before 0.10.14, 1.1.x before 1.1.12, 1.2.x before 1.2.7, 2.0.x before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.4 allows remote attackers to execute arbitrary code via a crafted Literal Run.

9.8 2019-10-13 CVE-2019-17542

FFmpeg before 4.2 has a heap-based buffer overflow in vqa_decode_chunk because of an out-of-array access in vqa_decode_init in libavcodec/vqavideo.c.

9.8 2019-10-13 CVE-2019-17539

In FFmpeg before 4.2, avcodec_open2 in libavcodec/utils.c allows a NULL pointer dereference and possibly unspecified other impact when there is no valid close function pointer.

8.8 2019-09-05 CVE-2019-15942

FFmpeg through 4.2 has a "Conditional jump or move depends on uninitialised value" issue in h2645_parse because alloc_rbsp_buffer in libavcodec/h2645_parse.c mishandles rbsp_buffer.

9.8 2019-06-04 CVE-2019-12730

aa_read_header in libavformat/aadec.c in FFmpeg before 3.2.14 and 4.x before 4.1.4 does not check for sscanf failure and consequently allows use of uninitialized variables.

8.8 2019-04-18 CVE-2019-11339

The studio profile decoder in libavcodec/mpeg4videodec.c in FFmpeg 4.0 before 4.0.4 and 4.1 before 4.1.2 allows remote attackers to cause a denial of service (out-of-array access) or possibly have unspecified other impact via crafted MPEG-4 video data.

7.5 2018-08-23 CVE-2018-15822

The flv_write_packet function in libavformat/flvenc.c in FFmpeg through 2.8 does not check for an empty audio packet, leading to an assertion failure.

6.5 2018-07-23 CVE-2018-1999015

FFmpeg before commit 5aba5b89d0b1d73164d3b81764828bb8b20ff32a contains an out of array read vulnerability in ASF_F format demuxer that can result in heap memory reading. This attack appear to be exploitable via specially crafted ASF file that has to provided as input. This vulnerability appears to have been fixed in 5aba5b89d0b1d73164d3b81764828bb8b20ff32a and later.

6.5 2018-07-23 CVE-2018-1999014

FFmpeg before commit bab0716c7f4793ec42e05a5aa7e80d82a0dd4e75 contains an out of array access vulnerability in MXF format demuxer that can result in DoS. This attack appear to be exploitable via specially crafted MXF file which has to be provided as input. This vulnerability appears to have been fixed in bab0716c7f4793ec42e05a5aa7e80d82a0dd4e75 and later.

CWE : Common Weakness Enumeration

%idName
36% (47) CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer
12% (16) CWE-125 Out-of-bounds Read
11% (15) CWE-20 Improper Input Validation
7% (10) CWE-787 Out-of-bounds Write
7% (10) CWE-189 Numeric Errors
5% (7) CWE-190 Integer Overflow or Wraparound
3% (5) CWE-476 NULL Pointer Dereference
3% (4) CWE-399 Resource Management Errors
3% (4) CWE-17 Code
1% (2) CWE-617 Reachable Assertion
1% (2) CWE-416 Use After Free
1% (2) CWE-200 Information Exposure
0% (1) CWE-415 Double Free
0% (1) CWE-369 Divide By Zero
0% (1) CWE-362 Race Condition
0% (1) CWE-252 Unchecked Return Value
0% (1) CWE-191 Integer Underflow (Wrap or Wraparound)

Nessus® Vulnerability Scanner

This CPE have more than 25 Relations. If you want to see a complete summary for this CPE, please contact us.
id Description
2019-01-08 Name: The remote Debian host is missing a security update.
File: debian_DLA-1630.nasl - Type: ACT_GATHER_INFO
2018-12-21 Name: The remote Debian host is missing a security update.
File: debian_DLA-1611.nasl - Type: ACT_GATHER_INFO
2018-11-27 Name: The remote Gentoo host is missing one or more security-related patches.
File: gentoo_GLSA-201811-19.nasl - Type: ACT_GATHER_INFO
2018-07-30 Name: The remote FreeBSD host is missing one or more security-related updates.
File: freebsd_pkg_5ccbb2f8c79811e7a633009c02a2ab30.nasl - Type: ACT_GATHER_INFO
2018-07-18 Name: The remote Debian host is missing a security-related update.
File: debian_DSA-4249.nasl - Type: ACT_GATHER_INFO
2017-11-28 Name: The remote Debian host is missing a security-related update.
File: debian_DSA-4049.nasl - Type: ACT_GATHER_INFO
2017-11-01 Name: The remote Debian host is missing a security-related update.
File: debian_DSA-4012.nasl - Type: ACT_GATHER_INFO
2017-10-23 Name: The remote Debian host is missing a security update.
File: debian_DLA-1142.nasl - Type: ACT_GATHER_INFO
2017-10-16 Name: The remote FreeBSD host is missing one or more security-related updates.
File: freebsd_pkg_ed73829daf6d11e7a633009c02a2ab30.nasl - Type: ACT_GATHER_INFO
2017-10-11 Name: The remote Debian host is missing a security-related update.
File: debian_DSA-3996.nasl - Type: ACT_GATHER_INFO
2017-09-18 Name: The remote openSUSE host is missing a security update.
File: openSUSE-2017-1068.nasl - Type: ACT_GATHER_INFO
2017-09-18 Name: The remote openSUSE host is missing a security update.
File: openSUSE-2017-1067.nasl - Type: ACT_GATHER_INFO
2017-08-29 Name: The remote Debian host is missing a security-related update.
File: debian_DSA-3957.nasl - Type: ACT_GATHER_INFO
2017-05-30 Name: The remote openSUSE host is missing a security update.
File: openSUSE-2017-631.nasl - Type: ACT_GATHER_INFO
2017-05-10 Name: The remote Gentoo host is missing one or more security-related patches.
File: gentoo_GLSA-201705-08.nasl - Type: ACT_GATHER_INFO
2017-04-28 Name: The remote openSUSE host is missing a security update.
File: openSUSE-2017-524.nasl - Type: ACT_GATHER_INFO
2017-04-10 Name: The remote openSUSE host is missing a security update.
File: openSUSE-2017-449.nasl - Type: ACT_GATHER_INFO
2017-01-30 Name: The remote Gentoo host is missing one or more security-related patches.
File: gentoo_GLSA-201701-71.nasl - Type: ACT_GATHER_INFO
2016-10-19 Name: The remote openSUSE host is missing a security update.
File: openSUSE-2016-1203.nasl - Type: ACT_GATHER_INFO
2016-10-05 Name: The remote Debian host is missing a security update.
File: debian_DLA-644.nasl - Type: ACT_GATHER_INFO
2016-06-20 Name: The remote Gentoo host is missing one or more security-related patches.
File: gentoo_GLSA-201606-09.nasl - Type: ACT_GATHER_INFO
2016-05-12 Name: The remote Debian host is missing a security update.
File: debian_DLA-464.nasl - Type: ACT_GATHER_INFO
2016-04-05 Name: The remote Ubuntu host is missing one or more security-related patches.
File: ubuntu_USN-2944-1.nasl - Type: ACT_GATHER_INFO
2016-03-14 Name: The remote Gentoo host is missing one or more security-related patches.
File: gentoo_GLSA-201603-09.nasl - Type: ACT_GATHER_INFO
2016-03-14 Name: The remote Gentoo host is missing one or more security-related patches.
File: gentoo_GLSA-201603-06.nasl - Type: ACT_GATHER_INFO