CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Ffmpeg : Security Vulnerabilities Published In 2013 (Overflow)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2013-7024 119 DoS Overflow 2013-12-09 2013-12-10
6.8
None Remote Medium Not required Partial Partial Partial
The jpeg2000_decode_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.1 does not consider the component number in certain calculations, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG2000 data.
2 CVE-2013-7023 119 DoS Overflow 2013-12-09 2013-12-10
6.8
None Remote Medium Not required Partial Partial Partial
The ff_combine_frame function in libavcodec/parser.c in FFmpeg before 2.1 does not properly handle certain memory-allocation errors, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted data.
3 CVE-2013-7022 119 DoS Overflow 2013-12-09 2013-12-10
6.8
None Remote Medium Not required Partial Partial Partial
The g2m_init_buffers function in libavcodec/g2meet.c in FFmpeg before 2.1 does not properly allocate memory for tiles, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Go2Webinar data.
4 CVE-2013-7020 119 DoS Overflow 2013-12-09 2013-12-10
6.8
None Remote Medium Not required Partial Partial Partial
The read_header function in libavcodec/ffv1dec.c in FFmpeg before 2.1 does not properly enforce certain bit-count and colorspace constraints, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted FFV1 data.
5 CVE-2013-7018 119 DoS Overflow 2013-12-09 2013-12-10
6.8
None Remote Medium Not required Partial Partial Partial
libavcodec/jpeg2000dec.c in FFmpeg before 2.1 does not ensure the use of valid code-block dimension values, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG2000 data.
6 CVE-2013-7016 119 DoS Overflow 2013-12-09 2013-12-10
6.8
None Remote Medium Not required Partial Partial Partial
The get_siz function in libavcodec/jpeg2000dec.c in FFmpeg before 2.1 does not ensure the expected sample separation, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG2000 data.
7 CVE-2013-7012 119 DoS Overflow 2013-12-09 2013-12-10
6.8
None Remote Medium Not required Partial Partial Partial
The get_siz function in libavcodec/jpeg2000dec.c in FFmpeg before 2.1 does not prevent attempts to use non-zero image offsets, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG2000 data.
8 CVE-2013-7011 119 DoS Overflow 2013-12-09 2013-12-10
6.8
None Remote Medium Not required Partial Partial Partial
The read_header function in libavcodec/ffv1dec.c in FFmpeg before 2.1 does not prevent changes to global parameters, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted FFV1 data.
9 CVE-2013-7009 119 DoS Overflow 2013-12-09 2013-12-10
6.8
None Remote Medium Not required Partial Partial Partial
The rpza_decode_stream function in libavcodec/rpza.c in FFmpeg before 2.1 does not properly maintain a pointer to pixel data, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Apple RPZA data.
10 CVE-2013-4264 119 DoS Overflow 2013-11-23 2014-03-05
4.3
None Remote Medium Not required None None Partial
The kempf_decode_tile function in libavcodec/g2meet.c in FFmpeg before 2.0.1 allows remote attackers to cause a denial of service (out-of-bounds heap write) via a G2M4 encoded file.
11 CVE-2013-4263 119 Overflow 2013-11-23 2013-12-13
7.5
None Remote Low Not required Partial Partial Partial
libavfilter in FFmpeg before 2.0.1 has unspecified impact and remote vectors related to a crafted "plane," which triggers an out-of-bounds heap write.
12 CVE-2013-3675 20 DoS Overflow 2013-06-09 2013-10-04
4.3
None Remote Medium Not required None None Partial
The process_frame_obj function in sanm.c in libavcodec in FFmpeg before 1.2.1 does not validate width and height values, which allows remote attackers to cause a denial of service (integer overflow, out-of-bounds array access, and application crash) via crafted LucasArts Smush video data.
13 CVE-2013-3673 119 DoS Overflow 2013-06-09 2013-06-10
4.3
None Remote Medium Not required None None Partial
The gif_decode_frame function in gifdec.c in libavcodec in FFmpeg before 1.2.1 does not properly manage the disposal methods of frames, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted GIF data.
14 CVE-2013-3670 119 DoS Overflow 2013-06-09 2013-06-10
4.3
None Remote Medium Not required None None Partial
The rle_unpack function in vmdav.c in libavcodec in FFmpeg git 20130328 through 20130501 does not properly use the bytestream2 API, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted RLE data. NOTE: the vendor has listed this as an issue fixed in 1.2.1, but the issue is actually in new code that was not shipped with the 1.2.1 release or any earlier release.
15 CVE-2013-2496 119 DoS Overflow 2013-03-09 2013-04-10
7.5
None Remote Low Not required Partial Partial Partial
The msrle_decode_8_16_24_32 function in msrledec.c in libavcodec in FFmpeg through 1.1.3 does not properly determine certain end pointers, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via crafted Microsoft RLE data.
16 CVE-2013-2495 189 DoS Overflow 2013-03-09 2013-04-10
7.5
None Remote Low Not required Partial Partial Partial
The iff_read_header function in iff.c in libavformat in FFmpeg through 1.1.3 does not properly handle data sizes for Interchange File Format (IFF) data during operations involving a CMAP chunk or a video codec, which allows remote attackers to cause a denial of service (integer overflow, out-of-bounds array access, and application crash) or possibly have unspecified other impact via a crafted header.
17 CVE-2013-0878 119 Overflow 2013-11-23 2014-02-27
9.3
None Remote Medium Not required Complete Complete Complete
The advance_line function in libavcodec/targa.c in FFmpeg before 1.1.3 allows remote attackers to have an unspecified impact via crafted Targa image data, related to an out-of-bounds array access.
18 CVE-2013-0877 119 Overflow 2013-11-23 2014-02-27
9.3
None Remote Medium Not required Complete Complete Complete
The old_codec37 function in libavcodec/sanm.c in FFmpeg before 1.1.3 allows remote attackers to have an unspecified impact via crafted LucasArts Smush data that has a large size when decoded, related to an out-of-bounds array access.
19 CVE-2013-0876 189 Overflow 2013-11-23 2013-11-25
9.3
None Remote Medium Not required Complete Complete Complete
Multiple integer overflows in the (1) old_codec37 and (2) old_codec47 functions in libavcodec/sanm.c in FFmpeg before 1.1.3 allow remote attackers to have an unspecified impact via crafted LucasArts Smush data, which triggers an out-of-bounds array access.
20 CVE-2013-0874 119 Overflow 2013-11-23 2013-11-25
9.3
None Remote Medium Not required Complete Complete Complete
The (1) doubles2str and (2) shorts2str functions in libavcodec/tiff.c in FFmpeg before 1.1.3 allow remote attackers to have an unspecified impact via a crafted TIFF image, related to an out-of-bounds array access.
21 CVE-2013-0872 119 Overflow 2013-11-23 2013-11-25
10.0
None Remote Low Not required Complete Complete Complete
The swr_init function in libswresample/swresample.c in FFmpeg before 1.1.3 allows remote attackers to have an unspecified impact via an invalid or unsupported (1) input or (2) output channel layout, related to an out-of-bounds array access.
22 CVE-2013-0869 119 Overflow 2013-11-23 2013-11-27
9.3
None Remote Medium Not required Complete Complete Complete
The field_end function in libavcodec/h264.c in FFmpeg before 1.1.2 allows remote attackers to have an unspecified impact via crafted H.264 data, related to an SPS and slice mismatch and an out-of-bounds array access.
23 CVE-2013-0868 119 Overflow 2013-11-23 2014-02-27
9.3
None Remote Medium Not required Complete Complete Complete
libavcodec/huffyuvdec.c in FFmpeg before 1.1.2 allows remote attackers to have an unspecified impact via crafted Huffyuv data, related to an out-of-bounds write and (1) unchecked return codes from the init_vlc function and (2) "len==0 cases."
24 CVE-2013-0866 119 Overflow 2013-11-23 2014-01-27
9.3
None Remote Medium Not required Complete Complete Complete
The aac_decode_init function in libavcodec/aacdec.c in FFmpeg before 1.0.4 and 1.1.x before 1.1.2 allows remote attackers to have an unspecified impact via a large number of channels in an AAC file, which triggers an out-of-bounds array access.
25 CVE-2013-0865 119 Overflow 2013-11-23 2014-03-08
9.3
None Remote Medium Not required Complete Complete Complete
The vqa_decode_chunk function in libavcodec/vqavideo.c in FFmpeg before 1.0.4 and 1.1.x before 1.1.2 allows remote attackers to have an unspecified impact via a large (1) cbp0 or (2) cbpz chunk in Westwood Studios VQA Video file, which triggers an out-of-bounds write.
26 CVE-2013-0863 119 Overflow 2013-11-23 2014-02-27
9.3
None Remote Medium Not required Complete Complete Complete
Buffer overflow in the rle_decode function in libavcodec/sanm.c in FFmpeg before 1.0.4 and 1.1.x before 1.1.2 allows remote attackers to have an unspecified impact via crafted LucasArts Smush video data.
27 CVE-2013-0862 189 Overflow 2013-11-23 2014-02-27
9.3
None Remote Medium Not required Complete Complete Complete
Multiple integer overflows in the process_frame_obj function in libavcodec/sanm.c in FFmpeg before 1.1.2 allow remote attackers to have an unspecified impact via crafted image dimensions in LucasArts Smush video data, which triggers an out-of-bounds array access.
28 CVE-2013-0861 119 Overflow Mem. Corr. 2013-11-23 2013-11-25
5.0
None Remote Low Not required None Partial None
The avcodec_decode_audio4 function in libavcodec/utils.c in FFmpeg before 1.0.4 and 1.1.x before 1.1.1 allows remote attackers to trigger memory corruption via vectors related to the channel layout.
29 CVE-2013-0855 189 Overflow 2013-12-07 2013-12-27
9.3
None Remote Medium Not required Complete Complete Complete
Integer overflow in the alac_decode_close function in libavcodec/alac.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via a large number of samples per frame in Apple Lossless Audio Codec (ALAC) data, which triggers an out-of-bounds array access.
30 CVE-2013-0852 119 Overflow 2013-12-07 2013-12-27
9.3
None Remote Medium Not required Complete Complete Complete
The parse_picture_segment function in libavcodec/pgssubdec.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via crafted RLE data, which triggers an out-of-bounds array access.
31 CVE-2013-0851 119 Overflow 2013-12-07 2013-12-27
9.3
None Remote Medium Not required Complete Complete Complete
The decode_frame function in libavcodec/eamad.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via crafted Electronic Arts Madcow video data, which triggers an out-of-bounds array access.
32 CVE-2013-0850 119 Overflow 2013-12-07 2014-01-27
9.3
None Remote Medium Not required Complete Complete Complete
The decode_slice_header function in libavcodec/h264.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via crafted H.264 data, which triggers an out-of-bounds array access.
33 CVE-2013-0848 119 Overflow 2013-12-07 2013-12-27
9.3
None Remote Medium Not required Complete Complete Complete
The decode_init function in libavcodec/huffyuv.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via a crafted width in huffyuv data with the predictor set to median and the colorspace set to YUV422P, which triggers an out-of-bounds array access.
34 CVE-2013-0847 119 Overflow 2013-12-07 2013-12-27
9.3
None Remote Medium Not required Complete Complete Complete
The ff_id3v2_parse function in libavformat/id3v2.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via ID3v2 header data, which triggers an out-of-bounds array access.
35 CVE-2013-0845 119 Overflow 2013-12-07 2014-03-08
9.3
None Remote Medium Not required Complete Complete Complete
libavcodec/alsdec.c in FFmpeg before 1.0.4 allows remote attackers to have an unspecified impact via a crafted block length, which triggers an out-of-bounds write.
36 CVE-2012-6618 119 DoS Overflow 2013-12-24 2014-02-20
2.6
None Remote High Not required None None Partial
The av_probe_input_buffer function in libavformat/utils.c in FFmpeg before 1.0.2, when running with certain -probesize values, allows remote attackers to cause a denial of service (crash) via a crafted MP3 file, possibly related to frame size or lack of sufficient "frames to estimate rate."
37 CVE-2012-6616 119 DoS Overflow 2013-12-24 2013-12-26
5.0
None Remote Low Not required None None Partial
The mov_text_decode_frame function in libavcodec/movtextdec.c in FFmpeg before 1.0.2 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via crafted 3GPP TS 26.245 data.
38 CVE-2011-4351 119 Exec Code Overflow 2013-12-09 2013-12-10
7.5
None Remote Low Not required Partial Partial Partial
Buffer overflow in FFmpeg before 0.5.6, 0.6.x before 0.6.4, 0.7.x before 0.7.8, and 0.8.x before 0.8.8 allows remote attackers to execute arbitrary code via unspecified vectors.
39 CVE-2011-3941 119 Overflow 2013-12-09 2014-01-03
7.5
None Remote Low Not required Partial Partial Partial
The decode_mb function in libavcodec/error_resilience.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact via vectors related to an uninitialized block index, which triggers an out-of-bounds write.
Total number of vulnerabilities : 39   Page : 1 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.