CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Libav : Security Vulnerabilities

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2017-11684 399 DoS 2017-07-27 2017-08-03
5.0
None Remote Low Not required None None Partial
There is an illegal address access in the build_table function in libavcodec/bitstream.c of Libav 12.1 that will lead to remote denial of service via crafted input.
2 CVE-2017-9987 119 DoS Overflow 2017-06-28 2017-07-03
5.0
None Remote Low Not required None None Partial
There is a heap-based buffer overflow in the function hpel_motion in mpegvideo_motion.c in libav 12.1. A crafted input can lead to a remote denial of service attack.
3 CVE-2017-9051 476 2017-05-18 2017-05-24
7.5
None Remote Low Not required Partial Partial Partial
libav before 12.1 is vulnerable to an invalid read of size 1 due to NULL pointer dereferencing in the nsv_read_chunk function in libavformat/nsvdec.c.
4 CVE-2017-7208 125 DoS +Info 2017-03-21 2017-03-23
5.8
None Remote Medium Not required Partial None Partial
The decode_residual function in libavcodec in libav 9.21 allows remote attackers to cause a denial of service (buffer over-read) or obtain sensitive information from process memory via a crafted h264 video file.
5 CVE-2017-7206 119 DoS Overflow +Info 2017-03-21 2017-03-23
5.8
None Remote Medium Not required Partial None Partial
The ff_h2645_extract_rbsp function in libavcodec in libav 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read) or obtain sensitive information from process memory via a crafted h264 video file.
6 CVE-2016-9826 189 DoS 2017-03-01 2017-03-02
4.3
None Remote Medium Not required None None Partial
libavcodec/ituh263dec.c in libav 11.8 allows remote attackers to cause a denial of service (crash) via vectors involving left shift of a negative value.
7 CVE-2016-9825 189 DoS 2017-03-01 2017-03-02
4.3
None Remote Medium Not required None None Partial
libswscale/utils.c in libav 11.8 allows remote attackers to cause a denial of service (crash) via vectors involving left shift of a negative value.
8 CVE-2016-9824 190 DoS Overflow 2017-03-01 2017-03-02
4.3
None Remote Medium Not required None None Partial
Integer overflow in libswscale/x86/swscale.c in libav 11.8 allows remote attackers to cause a denial of service (crash) via a crafted file.
9 CVE-2016-9823 119 DoS Overflow 2017-03-01 2017-03-02
4.3
None Remote Medium Not required None None Partial
libavcodec/x86/mpegvideo.c in libav 11.8 allows remote attackers to cause a denial of service (crash) via a crafted file.
10 CVE-2016-9822 190 DoS Overflow 2017-03-01 2017-03-02
4.3
None Remote Medium Not required None None Partial
Integer overflow in libavcodec/mpeg12dec.c in libav 11.8 allows remote attackers to cause a denial of service (crash) via a crafted file.
11 CVE-2016-9821 190 DoS Overflow 2017-03-01 2017-03-02
4.3
None Remote Medium Not required None None Partial
Integer overflow in libavcodec/mpegvideo_parser.c in libav 11.8 allows remote attackers to cause a denial of service (crash) via a crafted file.
12 CVE-2016-9820 189 DoS 2017-03-01 2017-03-02
4.3
None Remote Medium Not required None None Partial
libavcodec/mpegvideo_motion.c in libav 11.8 allows remote attackers to cause a denial of service (crash) via vectors involving left shift of a negative value.
13 CVE-2016-9819 189 DoS 2017-03-01 2017-03-02
4.3
None Remote Medium Not required None None Partial
libavcodec/mpegvideo.c in libav 11.8 allows remote attackers to cause a denial of service (crash) via vectors involving left shift of a negative value.
14 CVE-2016-8676 476 DoS 2017-02-15 2017-02-17
4.3
None Remote Medium Not required None None Partial
The get_vlc2 function in get_bits.h in Libav 11.9 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted mp3 file. NOTE: this issue exists due to an incomplete fix for CVE-2016-8675.
15 CVE-2016-8675 476 DoS 2017-02-15 2017-02-17
4.3
None Remote Medium Not required None None Partial
The get_vlc2 function in get_bits.h in Libav before 11.9 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted mp3 file, possibly related to startcode sequences during m4v detection.
16 CVE-2016-7499 369 DoS 2017-02-15 2017-02-17
4.3
None Remote Medium Not required None None Partial
The sbr_make_f_master function in aacsbr.c in Libav 11.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted mp3 file.
17 CVE-2016-7477 476 DoS 2017-02-15 2017-02-17
4.3
None Remote Medium Not required None None Partial
The ff_put_pixels8_xy2_mmx function in rnd_template.c in Libav 11.7 allows remote attackers to cause a denial of service (invalid memory access and crash) via a crafted mp3 file. NOTE: this issue was originally reported as involving a NULL pointer dereference.
18 CVE-2016-7424 476 DoS 2016-10-07 2016-10-11
4.3
None Remote Medium Not required None None Partial
The put_no_rnd_pixels8_xy2_mmx function in x86/rnd_template.c in libav 11.7 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted MP3 file.
19 CVE-2016-7393 125 DoS Overflow 2017-02-15 2017-02-17
4.3
None Remote Medium Not required None None Partial
Stack-based buffer overflow in the aac_sync function in aac_parser.c in Libav before 11.5 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.
20 CVE-2016-6832 119 DoS Overflow 2017-02-15 2017-02-17
4.3
None Remote Medium Not required None None Partial
Heap-based buffer overflow in the ff_audio_resample function in resample.c in libav before 11.4 allows remote attackers to cause a denial of service (crash) via vectors related to buffer resizing.
21 CVE-2016-3062 119 DoS Exec Code Overflow Mem. Corr. 2016-06-16 2017-06-30
6.8
None Remote Medium Not required Partial Partial Partial
The mov_read_dref function in libavformat/mov.c in Libav before 11.7 and FFmpeg before 0.11 allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via the entries value in a dref box in an MP4 file.
22 CVE-2015-5479 189 DoS 2016-04-19 2016-11-28
4.3
None Remote Medium Not required None None Partial
The ff_h263_decode_mba function in libavcodec/ituh263dec.c in Libav before 11.5 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a file with crafted dimensions.
23 CVE-2015-3395 119 Overflow 2015-06-16 2017-06-30
6.8
None Remote Medium Not required Partial Partial Partial
The msrle_decode_pal4 function in msrledec.c in Libav before 10.7 and 11.x before 11.4 and FFmpeg before 2.0.7, 2.2.x before 2.2.15, 2.4.x before 2.4.8, 2.5.x before 2.5.6, and 2.6.x before 2.6.2 allows remote attackers to have unspecified impact via a crafted image, related to a pixel pointer, which triggers an out-of-bounds array access.
24 CVE-2014-5271 119 DoS Exec Code Overflow 2014-11-03 2016-12-02
7.5
None Remote Low Not required Partial Partial Partial
Heap-based buffer overflow in the encode_slice function in libavcodec/proresenc_kostya.c in FFMpeg before 1.1.14, 1.2.x before 1.2.8, 2.x before 2.2.7, and 2.3.x before 2.3.3 and Libav before 10.5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors.
25 CVE-2014-3984 2014-06-06 2014-06-21
10.0
None Remote Low Not required Complete Complete Complete
Multiple unspecified vulnerabilities in Libav before 0.8.12 allow remote attackers to have unknown impact and vectors.
26 CVE-2012-5144 119 DoS Overflow Mem. Corr. 2012-12-12 2017-09-18
10.0
None Remote Low Not required Complete Complete Complete
Google Chrome before 23.0.1271.97, and Libav 0.7.x before 0.7.7 and 0.8.x before 0.8.5, do not properly perform AAC decoding, which allows remote attackers to cause a denial of service (stack memory corruption) or possibly have unspecified other impact via vectors related to "an off-by-one overwrite when switching to LTP profile from MAIN."
27 CVE-2012-2804 2012-09-10 2013-10-08
10.0
None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in libavcodec/indeo3.c in FFmpeg before 0.11 and Libav 0.8.x before 0.8.5 has unknown impact and attack vectors, related to "reallocation code" and the luma height and width.
28 CVE-2012-2803 399 2012-09-10 2013-10-08
10.0
None Remote Low Not required Complete Complete Complete
Double free vulnerability in the mpeg_decode_frame function in libavcodec/mpeg12.c in FFmpeg before 0.11, and Libav 0.7.x before 0.7.7 and 0.8.x before 0.8.5, has unknown impact and attack vectors, related to resetting the data size value.
29 CVE-2012-2802 2012-09-10 2013-12-13
10.0
None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in the ac3_decode_frame function in libavcodec/ac3dec.c in FFmpeg before 0.11 and Libav 0.8.x before 0.8.4 has unknown impact and attack vectors, related to the "number of output channels" and "out of array writes."
30 CVE-2012-2801 2012-09-10 2013-12-13
10.0
None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in libavcodec/avs.c in FFmpeg before 0.11, and Libav 0.7.x before 0.7.7 and 0.8.x before 0.8.4, has unknown impact and attack vectors, related to dimensions and "out of array writes."
31 CVE-2012-2800 2012-09-10 2013-12-13
10.0
None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in the ff_ivi_process_empty_tile function in libavcodec/ivi_common.c in FFmpeg before 0.11, and Libav 0.7.x before 0.7.7 and 0.8.x before 0.8.4, has unknown impact and attack vectors in which the "tile size ... mismatches parameters" and triggers "writing into a too small array."
32 CVE-2012-2798 2012-09-10 2013-12-13
10.0
None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in the decode_dds1 function in libavcodec/dfa.c in FFmpeg before 0.11, and Libav 0.7.x before 0.7.7 and 0.8.x before 0.8.4, has unknown impact and attack vectors, related to an "out of array write."
33 CVE-2012-2797 2012-09-10 2013-10-08
10.0
None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in the decode_frame_mp3on4 function in libavcodec/mpegaudiodec.c in FFmpeg before 0.11 and Libav 0.8.x before 0.8.5 has unknown impact and attack vectors related to a calculation that prevents a frame from being "large enough."
34 CVE-2012-2796 2012-09-10 2013-12-13
10.0
None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in the vc1_decode_frame function in libavcodec/vc1dec.c in FFmpeg before 0.11 and Libav 0.8.x before 0.8.4 has unknown impact and attack vectors, related to inconsistencies in "coded slice positions and interlacing" that trigger "out of array writes."
35 CVE-2012-2794 2012-09-10 2013-12-13
10.0
None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in the decode_mb_info function in libavcodec/indeo5.c in FFmpeg before 0.11, and Libav 0.7.x before 0.7.7 and 0.8.x before 0.8.4, has unknown impact and attack vectors in which the "allocated tile size ... mismatches parameters."
36 CVE-2012-2793 2012-09-10 2013-12-13
10.0
None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in the lag_decode_zero_run_line function in libavcodec/lagarith.c in FFmpeg before 0.11, and Libav 0.7.x before 0.7.7 and 0.8.x before 0.8.4, has unknown impact and attack vectors related to "too many zeros."
37 CVE-2012-2791 2012-09-10 2013-10-08
10.0
None Remote Low Not required Complete Complete Complete
Multiple unspecified vulnerabilities in the (1) decode_band_hdr function in indeo4.c and (2) ff_ivi_decode_blocks function in ivi_common.c in libavcodec/ in FFmpeg before 0.11, and Libav 0.7.x before 0.7.7 and 0.8.x before 0.8.5, have unknown impact and attack vectors, related to the "transform size."
38 CVE-2012-2790 2012-09-10 2013-12-13
10.0
None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in the read_var_block_data function in libavcodec/alsdec.c in FFmpeg before 0.11, and Libav 0.7.x before 0.7.7 and 0.8.x before 0.8.4, has unknown impact and attack vectors, related to the "number of decoded samples in first sub-block in BGMC mode."
39 CVE-2012-2789 2012-09-10 2013-12-13
10.0
None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in the avi_read_packet function in libavformat/avidec.c in FFmpeg before 0.11, and Libav 0.7.x before 0.7.7 and 0.8.x before 0.8.4, has unknown impact and attack vectors, related to a large number of vector coded coefficients (num_vec_coeffs).
40 CVE-2012-2788 2012-09-10 2013-12-13
10.0
None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in the avi_read_packet function in libavformat/avidec.c in FFmpeg before 0.11, and Libav 0.7.x before 0.7.7 and 0.8.x before 0.8.4, has unknown impact and attack vectors, related to an "out of array read" when a "packet is shrunk."
41 CVE-2012-2787 2012-09-10 2013-12-13
10.0
None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in the decode_frame function in libavcodec/indeo4.c in FFmpeg before 0.11 and Libav 0.8.x before 0.8.4 has unknown impact and attack vectors, related to the "setup width/height."
42 CVE-2012-2786 2012-09-10 2013-12-13
10.0
None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in the decode_wdlt function in libavcodec/dfa.c in FFmpeg before 0.11, and Libav 0.7.x before 0.7.7 and 0.8.x before 0.8.4, has unknown impact and attack vectors, related to an "out of array write."
43 CVE-2012-2784 2012-09-10 2013-12-13
10.0
None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in the decode_pic function in libavcodec/cavsdec.c in FFmpeg before 0.11, and Libav 0.7.x before 0.7.7 and 0.8.x before 0.8.4, has unknown impact and attack vectors, related to "width/height changing in CAVS," a different vulnerability than CVE-2012-2777.
44 CVE-2012-2783 2012-09-10 2013-10-07
10.0
None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in libavcodec/vp56.c in FFmpeg before 0.11, and Libav 0.7.x before 0.7.7 and 0.8.x before 0.8.5, has unknown impact and attack vectors, related to "freeing the returned frame."
45 CVE-2012-2779 2012-09-10 2013-12-13
10.0
None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in the decode_frame function in libavcodec/indeo5.c in FFmpeg before 0.11, and Libav 0.7.x before 0.7.7 and 0.8.x before 0.8.4, has unknown impact and attack vectors, related to an invalid "gop header" and decoding in a "half initialized context."
46 CVE-2012-2777 2012-09-10 2013-12-13
10.0
None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in the decode_pic function in libavcodec/cavsdec.c in FFmpeg before 0.11, and Libav 0.7.x before 0.7.7 and 0.8.x before 0.8.4, has unknown impact and attack vectors, related to "width/height changing in CAVS," a different vulnerability than CVE-2012-2784.
47 CVE-2012-2776 2012-09-10 2013-12-13
10.0
None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in the decode_cell_data function in libavcodec/indeo3.c in FFmpeg before 0.11 and Libav 0.8.x before 0.8.4 has unknown impact and attack vectors, related to an "out of picture write."
48 CVE-2012-2775 2012-09-10 2013-12-13
10.0
None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in the read_var_block_data function in libavcodec/alsdec.c in FFmpeg before 0.11, and Libav 0.7.x before 0.7.7 and 0.8.x before 0.8.4, has unknown impact and attack vectors, related to a large order and an "out of array write in quant_cof."
49 CVE-2012-2772 2012-09-10 2013-12-13
10.0
None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in the ff_rv34_decode_frame function in libavcodec/rv34.c in FFmpeg before 0.11, and Libav 0.7.x before 0.7.7 and 0.8.x before 0.8.4, has unknown impact and attack vectors, related to "width/height changing with frame threading."
50 CVE-2012-0947 119 DoS Exec Code Overflow 2012-08-20 2012-11-26
6.8
None Remote Medium Not required Partial Partial Partial
Heap-based buffer overflow in the vqa_decode_chunk function in the VQA codec (vqavideo.c) in libavcodec in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.6, and 0.8.x before 0.8.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted VQA media file in which the image size is not a multiple of the block size.
Total number of vulnerabilities : 68   Page : 1 (This Page)2
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.