CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Ffmpeg : Security Vulnerabilities (CVSS score between 2 and 5.99)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2009-4632 189 DoS 2010-02-10 2011-10-26
5.8
 None Remote Medium Not required Partial None Partial
oggparsevorbis.c in FFmpeg 0.5 does not properly perform certain pointer arithmetic, which might allow remote attackers to obtain sensitive memory contents and cause a denial of service via a crafted file that triggers an out-of-bounds read.
2 CVE-2009-4636 94 DoS 2010-02-10 2011-10-26
4.3
 None Remote Medium Not required None None Partial
FFmpeg 0.5 allows remote attackers to cause a denial of service (hang) via a crafted file that triggers an infinite loop.
3 CVE-2009-4638 189 DoS Exec Code Overflow 2010-02-10 2010-05-04
4.3
 None Remote Medium Not required None None Partial
Integer overflow in FFmpeg 0.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors.
4 CVE-2009-4639 189 DoS 2010-02-10 2011-10-26
4.3
 None Remote Medium Not required None None Partial
The av_rescale_rnd function in the AVI demuxer in FFmpeg 0.5 allows remote attackers to cause a denial of service (crash) via a crafted AVI file that triggers a divide-by-zero error.
5 CVE-2009-4640 189 DoS Exec Code 2010-02-10 2011-10-26
4.3
 None Remote Medium Not required None None Partial
Array index error in vorbis_dec.c in FFmpeg 0.5 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted Vorbis file that triggers an out-of-bounds read.
6 CVE-2010-4704 20 DoS 2011-01-22 2011-10-26
4.3
 None Remote Medium Not required None None Partial
libavcodec/vorbis_dec.c in the Vorbis decoder in FFmpeg 0.6.1 and earlier allows remote attackers to cause a denial of service (application crash) via a crafted .ogg file, related to the vorbis_floor0_decode function. NOTE: this might overlap CVE-2011-0480.
7 CVE-2011-2161 399 DoS 2011-05-20 2018-10-17
4.3
 None Remote Medium Not required None None Partial
The ape_read_header function in ape.c in libavformat in FFmpeg before 0.5.4, as used in MPlayer, VideoLAN VLC media player, and other products, allows remote attackers to cause a denial of service (application crash) via an APE (aka Monkey's Audio) file that contains a header but no frames.
8 CVE-2011-3936 20 DoS 2012-08-20 2012-10-30
4.3
 None Remote Medium Not required None None Partial
The dv_extract_audio function in libavcodec in FFmpeg 0.7.x before 0.7.12 and 0.8.x before 0.8.11 and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.5, and 0.8.x before 0.8.1 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted DV file.
9 CVE-2011-3973 399 DoS 2011-10-02 2012-08-22
5.0
 None Remote Low Not required None None Partial
cavsdec.c in libavcodec in FFmpeg before 0.7.4 and 0.8.x before 0.8.3 allows remote attackers to cause a denial of service (incorrect write operation and application crash) via an invalid bitstream in a Chinese AVS video (aka CAVS) file, related to the decode_residual_block, check_for_slice, and cavs_decode_frame functions, a different vulnerability than CVE-2011-3362.
10 CVE-2011-3974 189 DoS 2011-10-02 2012-08-22
5.0
 None Remote Low Not required None None Partial
Integer signedness error in the decode_residual_inter function in cavsdec.c in libavcodec in FFmpeg before 0.7.4 and 0.8.x before 0.8.3 allows remote attackers to cause a denial of service (incorrect write operation and application crash) via an invalid bitstream in a Chinese AVS video (aka CAVS) file, a different vulnerability than CVE-2011-3362.
11 CVE-2011-4353 119 DoS Overflow 2012-08-20 2012-08-21
4.3
 None Remote Medium Not required None None Partial
The (1) av_image_fill_pointers, (2) vp5_parse_coeff, and (3) vp6_parse_coeff functions in FFmpeg 0.5.x before 0.5.7, 0.6.x before 0.6.4, 0.7.x before 0.7.9, and 0.8.x before 0.8.8; and in Libav 0.5.x before 0.5.6, 0.6.x before 0.6.4, and 0.7.x before 0.7.3 allow remote attackers to cause a denial of service (out-of-bounds read) via a crafted VP5 or VP6 stream.
12 CVE-2011-4579 119 DoS Overflow Mem. Corr. 2012-08-20 2012-08-21
4.3
 None Remote Medium Not required None None Partial
The svq1_decode_frame function in the SVQ1 decoder (svq1dec.c) in libavcodec in FFmpeg 0.5.x before 0.5.7, 0.6.x before 0.6.4, 0.7.x before 0.7.9, and 0.8.x before 0.8.8; and in Libav 0.5.x before 0.5.6, 0.6.x before 0.6.4, and 0.7.x before 0.7.3 allows remote attackers to cause a denial of service (memory corruption) via a crafted SVQ1 stream, related to "dimensions changed."
13 CVE-2012-0847 119 DoS Overflow 2012-08-20 2012-08-21
4.3
 None Remote Medium Not required None None Partial
Heap-based buffer overflow in the avfilter_filter_samples function in libavfilter/avfilter.c in FFmpeg before 0.9.1 allows remote attackers to cause a denial of service (application crash) via a crafted media file.
14 CVE-2012-0848 119 DoS Overflow 2012-08-20 2017-08-29
4.3
 None Remote Medium Not required None None Partial
Heap-based buffer overflow in the ws_snd_decode_frame function in libavcodec/ws-snd1.c in FFmpeg 0.9.1 allows remote attackers to cause a denial of service (application crash) via a crafted media file, related to an incorrect calculation, aka "wrong samples count."
15 CVE-2012-0849 189 DoS Overflow 2012-08-27 2018-10-30
4.3
 None Remote Medium Not required None None Partial
Integer overflow in the ff_j2k_dwt_init function in libavcodec/j2k_dwt.c in FFmpeg before 0.9.1 allows remote attackers to cause a denial of service (segmentation fault and application crash) via a crafted JPEG2000 image that triggers an incorrect check for a negative value.
16 CVE-2012-0850 119 DoS Overflow Mem. Corr. 2012-08-20 2018-10-30
4.3
 None Remote Medium Not required None None Partial
The sbr_qmf_synthesis function in libavcodec/aacsbr.c in FFmpeg before 0.9.1 allows remote attackers to cause a denial of service (application crash) via a crafted mpg file that triggers memory corruption involving the v_off variable, probably a buffer underflow.
17 CVE-2012-0854 119 DoS Overflow 2012-08-20 2018-10-30
5.0
 None Remote Low Not required None None Partial
The dpcm_decode_frame function in libavcodec/dpcm.c in FFmpeg before 0.9.1 does not use the proper pointer after an audio API change, which allows remote attackers to cause a denial of service (application crash) via unspecified vectors, which triggers a heap-based buffer overflow.
18 CVE-2012-0855 119 DoS Overflow 2012-08-27 2018-10-30
5.0
 None Remote Low Not required None None Partial
Heap-based buffer overflow in the get_sot function in the J2K decoder (j2k.c) in libavcodec in FFmpeg before 0.9.1 allows remote attackers to cause a denial of service (application crash) via unspecified vectors related to the curtileno variable.
19 CVE-2012-0856 119 DoS Overflow 2012-08-20 2018-10-30
2.6
 None Remote High Not required None None Partial
Heap-based buffer overflow in the MPV_frame_start function in libavcodec/mpegvideo.c in FFmpeg before 0.9.1, when the lowres option is enabled, allows remote attackers to cause a denial of service (application crash) via a crafted H263 media file. NOTE: this vulnerability exists because of a regression error.
20 CVE-2012-0857 119 DoS Overflow 2012-08-20 2018-10-30
5.0
 None Remote Low Not required None None Partial
Multiple buffer overflows in the get_qcx function in the J2K decoder (j2kdec.c) in libavcode in FFmpeg before 0.9.1 allow remote attackers to cause a denial of service (application crash) via unspecified vectors.
21 CVE-2012-2774 119 DoS Overflow Mem. Corr. 2012-09-10 2018-10-30
5.0
 None Remote Low Not required None None Partial
The ff_MPV_frame_start function in libavcodec/mpegvideo.c in FFmpeg before 0.11 allows remote attackers to cause a denial of service (memory corruption) via unspecified vectors, related to starting "a frame outside SETUP state."
22 CVE-2012-2805 404 DoS 2017-08-28 2017-08-31
5.0
 None Remote Low Not required None None Partial
Unspecified vulnerability in FFMPEG 0.10 allows remote attackers to cause a denial of service.
23 CVE-2012-6615 DoS 2013-12-24 2013-12-26
4.3
 None Remote Medium Not required None None Partial
The ff_ass_split_override_codes function in libavcodec/ass_split.c in FFmpeg before 1.0.2 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a subtitle dialog without text.
24 CVE-2012-6616 119 DoS Overflow 2013-12-24 2013-12-26
5.0
 None Remote Low Not required None None Partial
The mov_text_decode_frame function in libavcodec/movtextdec.c in FFmpeg before 1.0.2 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via crafted 3GPP TS 26.245 data.
25 CVE-2012-6617 DoS 2013-12-24 2013-12-26
4.3
 None Remote Medium Not required None None Partial
The prepare_sdp_description function in ffserver.c in FFmpeg before 1.0.2 allows remote attackers to cause a denial of service (crash) via vectors related to the rtp format.
26 CVE-2012-6618 119 DoS Overflow 2013-12-24 2014-02-21
2.6
 None Remote High Not required None None Partial
The av_probe_input_buffer function in libavformat/utils.c in FFmpeg before 1.0.2, when running with certain -probesize values, allows remote attackers to cause a denial of service (crash) via a crafted MP3 file, possibly related to frame size or lack of sufficient "frames to estimate rate."
27 CVE-2013-0860 20 2013-11-23 2016-12-03
4.3
 None Remote Medium Not required None None Partial
The ff_er_frame_end function in libavcodec/error_resilience.c in FFmpeg before 1.0.4 and 1.1.x before 1.1.1 does not properly verify that a frame is fully initialized, which allows remote attackers to trigger a NULL pointer dereference via crafted picture data.
28 CVE-2013-0861 119 Overflow Mem. Corr. 2013-11-23 2016-12-03
5.0
 None Remote Low Not required None Partial None
The avcodec_decode_audio4 function in libavcodec/utils.c in FFmpeg before 1.0.4 and 1.1.x before 1.1.1 allows remote attackers to trigger memory corruption via vectors related to the channel layout.
29 CVE-2013-3670 119 DoS Overflow 2013-06-10 2013-06-10
4.3
 None Remote Medium Not required None None Partial
The rle_unpack function in vmdav.c in libavcodec in FFmpeg git 20130328 through 20130501 does not properly use the bytestream2 API, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted RLE data. NOTE: the vendor has listed this as an issue fixed in 1.2.1, but the issue is actually in new code that was not shipped with the 1.2.1 release or any earlier release.
30 CVE-2013-3671 189 DoS 2013-06-10 2013-06-10
4.3
 None Remote Medium Not required None None Partial
The format_line function in log.c in libavutil in FFmpeg before 1.2.1 uses inapplicable offset data during a certain category calculation, which allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via crafted data that triggers a log message.
31 CVE-2013-3672 20 DoS 2013-06-10 2015-10-28
4.3
 None Remote Medium Not required None None Partial
The mm_decode_inter function in mmvideo.c in libavcodec in FFmpeg before 1.2.1 does not validate the relationship between a horizontal coordinate and a width value, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted American Laser Games (ALG) MM Video data.
32 CVE-2013-3673 119 DoS Overflow 2013-06-10 2013-06-10
4.3
 None Remote Medium Not required None None Partial
The gif_decode_frame function in gifdec.c in libavcodec in FFmpeg before 1.2.1 does not properly manage the disposal methods of frames, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted GIF data.
33 CVE-2013-3674 20 DoS 2013-06-10 2015-10-28
4.3
 None Remote Medium Not required None None Partial
The cdg_decode_frame function in cdgraphics.c in libavcodec in FFmpeg before 1.2.1 does not validate the presence of non-header data in a buffer, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted CD Graphics Video data.
34 CVE-2013-3675 20 DoS Overflow 2013-06-10 2013-10-04
4.3
 None Remote Medium Not required None None Partial
The process_frame_obj function in sanm.c in libavcodec in FFmpeg before 1.2.1 does not validate width and height values, which allows remote attackers to cause a denial of service (integer overflow, out-of-bounds array access, and application crash) via crafted LucasArts Smush video data.
35 CVE-2013-4264 119 DoS Overflow 2013-11-23 2016-12-03
4.3
 None Remote Medium Not required None None Partial
The kempf_decode_tile function in libavcodec/g2meet.c in FFmpeg before 2.0.1 allows remote attackers to cause a denial of service (out-of-bounds heap write) via a G2M4 encoded file.
36 CVE-2013-4358 DoS 2013-12-24 2013-12-26
5.0
 None Remote Low Not required None None Partial
libavcodec/h264.c in FFmpeg before 0.11.4 allows remote attackers to cause a denial of service (crash) via vectors related to alternating bit depths in H.264 data.
37 CVE-2014-9319 119 DoS Overflow 2014-12-09 2016-12-03
5.0
 None Remote Low Not required None None Partial
The ff_hevc_decode_nal_sps function in libavcodec/hevc_ps.c in FFMpeg before 2.1.6, 2.2.x through 2.3.x, and 2.4.x before 2.4.4 allows remote attackers to cause a denial of service (out-of-bounds access) via a crafted .bit file.
38 CVE-2014-125002 787 Mem. Corr. 2022-06-18 2022-06-27
4.3
 None Remote Medium Not required None None Partial
A vulnerability was found in FFmpeg 2.0. It has been classified as problematic. Affected is the function dnxhd_init_rc of the file libavcodec/dnxhdenc.c. The manipulation leads to memory corruption. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue.
39 CVE-2014-125003 787 Mem. Corr. 2022-06-18 2022-06-27
4.3
 None Remote Medium Not required None None Partial
A vulnerability was found in FFmpeg 2.0 and classified as problematic. This issue affects the function get_siz of the file libavcodec/jpeg2000dec.c. The manipulation leads to memory corruption. The attack may be initiated remotely. It is recommended to apply a patch to fix this issue.
40 CVE-2014-125004 787 Mem. Corr. 2022-06-18 2022-06-27
4.3
 None Remote Medium Not required None None Partial
A vulnerability has been found in FFmpeg 2.0 and classified as problematic. This vulnerability affects the function decode_hextile of the file libavcodec/vmnc.c. The manipulation leads to memory corruption. The attack can be initiated remotely. It is recommended to apply a patch to fix this issue.
41 CVE-2014-125005 787 Mem. Corr. 2022-06-18 2022-06-27
4.3
 None Remote Medium Not required None None Partial
A vulnerability, which was classified as problematic, was found in FFmpeg 2.0. This affects the function decode_vol_header of the file libavcodec/mpeg4videodec.c. The manipulation leads to memory corruption. It is possible to initiate the attack remotely. It is recommended to apply a patch to fix this issue.
42 CVE-2014-125006 787 Mem. Corr. 2022-06-18 2022-06-27
4.3
 None Remote Medium Not required None None Partial
A vulnerability, which was classified as problematic, has been found in FFmpeg 2.0. Affected by this issue is the function output_frame of the file libavcodec/h264.c. The manipulation leads to memory corruption. The attack may be launched remotely. It is recommended to apply a patch to fix this issue.
43 CVE-2014-125007 787 Mem. Corr. 2022-06-18 2022-06-27
4.3
 None Remote Medium Not required None None Partial
A vulnerability classified as problematic was found in FFmpeg 2.0. Affected by this vulnerability is the function intra_pred of the file libavcodec/hevcpred_template.c. The manipulation leads to memory corruption. The attack can be launched remotely. It is recommended to apply a patch to fix this issue.
44 CVE-2014-125008 787 Mem. Corr. 2022-06-18 2022-06-27
4.3
 None Remote Medium Not required None None Partial
A vulnerability classified as problematic has been found in FFmpeg 2.0. Affected is the function vorbis_header of the file libavformat/oggparsevorbis.c. The manipulation leads to memory corruption. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue.
45 CVE-2014-125009 787 Mem. Corr. 2022-06-18 2022-06-27
4.3
 None Remote Medium Not required None None Partial
A vulnerability classified as problematic has been found in FFmpeg 2.0. This affects the function add_yblock of the file libavcodec/snow.h. The manipulation leads to memory corruption. It is possible to initiate the attack remotely. It is recommended to apply a patch to fix this issue.
46 CVE-2014-125010 787 Mem. Corr. 2022-06-18 2022-06-27
4.3
 None Remote Medium Not required None None Partial
A vulnerability was found in FFmpeg 2.0. It has been rated as critical. Affected by this issue is the function decode_slice_header of the file libavcodec/h64.c. The manipulation leads to memory corruption. The attack may be launched remotely. It is recommended to apply a patch to fix this issue.
47 CVE-2014-125012 681 2022-06-18 2022-06-27
4.3
 None Remote Medium Not required None None Partial
A vulnerability was found in FFmpeg 2.0. It has been classified as problematic. Affected is an unknown function of the file libavcodec/dxtroy.c. The manipulation leads to integer coercion error. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue.
48 CVE-2014-125013 787 Mem. Corr. 2022-06-18 2022-06-27
4.3
 None Remote Medium Not required None None Partial
A vulnerability was found in FFmpeg 2.0 and classified as problematic. This issue affects the function msrle_decode_frame of the file libavcodec/msrle.c. The manipulation leads to memory corruption. The attack may be initiated remotely. It is recommended to apply a patch to fix this issue.
49 CVE-2014-125014 787 Mem. Corr. 2022-06-18 2022-06-27
4.3
 None Remote Medium Not required None None Partial
A vulnerability classified as problematic was found in FFmpeg 2.0. Affected by this vulnerability is an unknown functionality of the component HEVC Video Decoder. The manipulation leads to memory corruption. The attack can be launched remotely. It is recommended to apply a patch to fix this issue.
50 CVE-2014-125016 787 Mem. Corr. 2022-06-18 2022-06-27
4.3
 None Remote Medium Not required None None Partial
A vulnerability was found in FFmpeg 2.0. It has been rated as problematic. This issue affects the function ff_init_buffer_info of the file utils.c. The manipulation leads to memory corruption. The attack may be initiated remotely. It is recommended to apply a patch to fix this issue.
Total number of vulnerabilities : 139   Page : 1 (This Page)2 3
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.