# |
CVE ID
|
CWE ID
|
# of Exploits
|
Vulnerability Type(s)
|
Publish Date
|
Update Date
|
Score
|
Gained Access Level
|
Access
|
Complexity
|
Authentication
|
Conf.
|
Integ.
|
Avail.
|
1 |
CVE-2009-4632 |
189 |
|
DoS |
2010-02-09 |
2011-10-25 |
5.8 |
None |
Remote |
Medium |
Not required |
Partial |
None |
Partial |
oggparsevorbis.c in FFmpeg 0.5 does not properly perform certain pointer arithmetic, which might allow remote attackers to obtain sensitive memory contents and cause a denial of service via a crafted file that triggers an out-of-bounds read. |
2 |
CVE-2009-4636 |
94 |
|
DoS |
2010-02-09 |
2011-10-25 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
FFmpeg 0.5 allows remote attackers to cause a denial of service (hang) via a crafted file that triggers an infinite loop. |
3 |
CVE-2009-4638 |
189 |
|
DoS Exec Code Overflow |
2010-02-09 |
2010-05-04 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
Integer overflow in FFmpeg 0.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors. |
4 |
CVE-2009-4639 |
189 |
|
DoS |
2010-02-09 |
2011-10-25 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
The av_rescale_rnd function in the AVI demuxer in FFmpeg 0.5 allows remote attackers to cause a denial of service (crash) via a crafted AVI file that triggers a divide-by-zero error. |
5 |
CVE-2009-4640 |
189 |
|
DoS Exec Code |
2010-02-09 |
2011-10-25 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
Array index error in vorbis_dec.c in FFmpeg 0.5 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted Vorbis file that triggers an out-of-bounds read. |
6 |
CVE-2010-4704 |
20 |
|
DoS |
2011-01-22 |
2011-10-25 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
libavcodec/vorbis_dec.c in the Vorbis decoder in FFmpeg 0.6.1 and earlier allows remote attackers to cause a denial of service (application crash) via a crafted .ogg file, related to the vorbis_floor0_decode function. NOTE: this might overlap CVE-2011-0480. |
7 |
CVE-2011-2161 |
399 |
|
DoS |
2011-05-20 |
2018-10-17 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
The ape_read_header function in ape.c in libavformat in FFmpeg before 0.5.4, as used in MPlayer, VideoLAN VLC media player, and other products, allows remote attackers to cause a denial of service (application crash) via an APE (aka Monkey's Audio) file that contains a header but no frames. |
8 |
CVE-2011-3936 |
20 |
|
DoS |
2012-08-20 |
2012-10-29 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
The dv_extract_audio function in libavcodec in FFmpeg 0.7.x before 0.7.12 and 0.8.x before 0.8.11 and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.5, and 0.8.x before 0.8.1 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted DV file. |
9 |
CVE-2011-3973 |
399 |
|
DoS |
2011-10-02 |
2012-08-21 |
5.0 |
None |
Remote |
Low |
Not required |
None |
None |
Partial |
cavsdec.c in libavcodec in FFmpeg before 0.7.4 and 0.8.x before 0.8.3 allows remote attackers to cause a denial of service (incorrect write operation and application crash) via an invalid bitstream in a Chinese AVS video (aka CAVS) file, related to the decode_residual_block, check_for_slice, and cavs_decode_frame functions, a different vulnerability than CVE-2011-3362. |
10 |
CVE-2011-3974 |
189 |
|
DoS |
2011-10-02 |
2012-08-21 |
5.0 |
None |
Remote |
Low |
Not required |
None |
None |
Partial |
Integer signedness error in the decode_residual_inter function in cavsdec.c in libavcodec in FFmpeg before 0.7.4 and 0.8.x before 0.8.3 allows remote attackers to cause a denial of service (incorrect write operation and application crash) via an invalid bitstream in a Chinese AVS video (aka CAVS) file, a different vulnerability than CVE-2011-3362. |
11 |
CVE-2011-4353 |
119 |
|
DoS Overflow |
2012-08-20 |
2012-08-21 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
The (1) av_image_fill_pointers, (2) vp5_parse_coeff, and (3) vp6_parse_coeff functions in FFmpeg 0.5.x before 0.5.7, 0.6.x before 0.6.4, 0.7.x before 0.7.9, and 0.8.x before 0.8.8; and in Libav 0.5.x before 0.5.6, 0.6.x before 0.6.4, and 0.7.x before 0.7.3 allow remote attackers to cause a denial of service (out-of-bounds read) via a crafted VP5 or VP6 stream. |
12 |
CVE-2011-4579 |
119 |
|
DoS Overflow Mem. Corr. |
2012-08-20 |
2012-08-21 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
The svq1_decode_frame function in the SVQ1 decoder (svq1dec.c) in libavcodec in FFmpeg 0.5.x before 0.5.7, 0.6.x before 0.6.4, 0.7.x before 0.7.9, and 0.8.x before 0.8.8; and in Libav 0.5.x before 0.5.6, 0.6.x before 0.6.4, and 0.7.x before 0.7.3 allows remote attackers to cause a denial of service (memory corruption) via a crafted SVQ1 stream, related to "dimensions changed." |
13 |
CVE-2012-0847 |
119 |
|
DoS Overflow |
2012-08-20 |
2012-08-21 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
Heap-based buffer overflow in the avfilter_filter_samples function in libavfilter/avfilter.c in FFmpeg before 0.9.1 allows remote attackers to cause a denial of service (application crash) via a crafted media file. |
14 |
CVE-2012-0848 |
119 |
|
DoS Overflow |
2012-08-20 |
2017-08-28 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
Heap-based buffer overflow in the ws_snd_decode_frame function in libavcodec/ws-snd1.c in FFmpeg 0.9.1 allows remote attackers to cause a denial of service (application crash) via a crafted media file, related to an incorrect calculation, aka "wrong samples count." |
15 |
CVE-2012-0849 |
189 |
|
DoS Overflow |
2012-08-27 |
2018-10-30 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
Integer overflow in the ff_j2k_dwt_init function in libavcodec/j2k_dwt.c in FFmpeg before 0.9.1 allows remote attackers to cause a denial of service (segmentation fault and application crash) via a crafted JPEG2000 image that triggers an incorrect check for a negative value. |
16 |
CVE-2012-0850 |
119 |
|
DoS Overflow Mem. Corr. |
2012-08-20 |
2018-10-30 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
The sbr_qmf_synthesis function in libavcodec/aacsbr.c in FFmpeg before 0.9.1 allows remote attackers to cause a denial of service (application crash) via a crafted mpg file that triggers memory corruption involving the v_off variable, probably a buffer underflow. |
17 |
CVE-2012-0854 |
119 |
|
DoS Overflow |
2012-08-20 |
2018-10-30 |
5.0 |
None |
Remote |
Low |
Not required |
None |
None |
Partial |
The dpcm_decode_frame function in libavcodec/dpcm.c in FFmpeg before 0.9.1 does not use the proper pointer after an audio API change, which allows remote attackers to cause a denial of service (application crash) via unspecified vectors, which triggers a heap-based buffer overflow. |
18 |
CVE-2012-0855 |
119 |
|
DoS Overflow |
2012-08-27 |
2018-10-30 |
5.0 |
None |
Remote |
Low |
Not required |
None |
None |
Partial |
Heap-based buffer overflow in the get_sot function in the J2K decoder (j2k.c) in libavcodec in FFmpeg before 0.9.1 allows remote attackers to cause a denial of service (application crash) via unspecified vectors related to the curtileno variable. |
19 |
CVE-2012-0857 |
119 |
|
DoS Overflow |
2012-08-20 |
2018-10-30 |
5.0 |
None |
Remote |
Low |
Not required |
None |
None |
Partial |
Multiple buffer overflows in the get_qcx function in the J2K decoder (j2kdec.c) in libavcode in FFmpeg before 0.9.1 allow remote attackers to cause a denial of service (application crash) via unspecified vectors. |
20 |
CVE-2012-2774 |
119 |
|
DoS Overflow Mem. Corr. |
2012-09-10 |
2018-10-30 |
5.0 |
None |
Remote |
Low |
Not required |
None |
None |
Partial |
The ff_MPV_frame_start function in libavcodec/mpegvideo.c in FFmpeg before 0.11 allows remote attackers to cause a denial of service (memory corruption) via unspecified vectors, related to starting "a frame outside SETUP state." |
21 |
CVE-2012-2805 |
404 |
|
DoS |
2017-08-28 |
2017-08-31 |
5.0 |
None |
Remote |
Low |
Not required |
None |
None |
Partial |
Unspecified vulnerability in FFMPEG 0.10 allows remote attackers to cause a denial of service. |
22 |
CVE-2012-6615 |
|
|
DoS |
2013-12-24 |
2013-12-26 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
The ff_ass_split_override_codes function in libavcodec/ass_split.c in FFmpeg before 1.0.2 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a subtitle dialog without text. |
23 |
CVE-2012-6616 |
119 |
|
DoS Overflow |
2013-12-24 |
2013-12-26 |
5.0 |
None |
Remote |
Low |
Not required |
None |
None |
Partial |
The mov_text_decode_frame function in libavcodec/movtextdec.c in FFmpeg before 1.0.2 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via crafted 3GPP TS 26.245 data. |
24 |
CVE-2012-6617 |
|
|
DoS |
2013-12-24 |
2013-12-26 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
The prepare_sdp_description function in ffserver.c in FFmpeg before 1.0.2 allows remote attackers to cause a denial of service (crash) via vectors related to the rtp format. |
25 |
CVE-2013-0860 |
20 |
|
|
2013-11-23 |
2016-12-02 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
The ff_er_frame_end function in libavcodec/error_resilience.c in FFmpeg before 1.0.4 and 1.1.x before 1.1.1 does not properly verify that a frame is fully initialized, which allows remote attackers to trigger a NULL pointer dereference via crafted picture data. |
26 |
CVE-2013-0861 |
119 |
|
Overflow Mem. Corr. |
2013-11-23 |
2016-12-02 |
5.0 |
None |
Remote |
Low |
Not required |
None |
Partial |
None |
The avcodec_decode_audio4 function in libavcodec/utils.c in FFmpeg before 1.0.4 and 1.1.x before 1.1.1 allows remote attackers to trigger memory corruption via vectors related to the channel layout. |
27 |
CVE-2013-3670 |
119 |
|
DoS Overflow |
2013-06-09 |
2013-06-10 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
The rle_unpack function in vmdav.c in libavcodec in FFmpeg git 20130328 through 20130501 does not properly use the bytestream2 API, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted RLE data. NOTE: the vendor has listed this as an issue fixed in 1.2.1, but the issue is actually in new code that was not shipped with the 1.2.1 release or any earlier release. |
28 |
CVE-2013-3671 |
189 |
|
DoS |
2013-06-09 |
2013-06-10 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
The format_line function in log.c in libavutil in FFmpeg before 1.2.1 uses inapplicable offset data during a certain category calculation, which allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via crafted data that triggers a log message. |
29 |
CVE-2013-3672 |
20 |
|
DoS |
2013-06-09 |
2015-10-27 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
The mm_decode_inter function in mmvideo.c in libavcodec in FFmpeg before 1.2.1 does not validate the relationship between a horizontal coordinate and a width value, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted American Laser Games (ALG) MM Video data. |
30 |
CVE-2013-3673 |
119 |
|
DoS Overflow |
2013-06-09 |
2013-06-10 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
The gif_decode_frame function in gifdec.c in libavcodec in FFmpeg before 1.2.1 does not properly manage the disposal methods of frames, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted GIF data. |
31 |
CVE-2013-3674 |
20 |
|
DoS |
2013-06-09 |
2015-10-27 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
The cdg_decode_frame function in cdgraphics.c in libavcodec in FFmpeg before 1.2.1 does not validate the presence of non-header data in a buffer, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted CD Graphics Video data. |
32 |
CVE-2013-3675 |
20 |
|
DoS Overflow |
2013-06-09 |
2013-10-04 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
The process_frame_obj function in sanm.c in libavcodec in FFmpeg before 1.2.1 does not validate width and height values, which allows remote attackers to cause a denial of service (integer overflow, out-of-bounds array access, and application crash) via crafted LucasArts Smush video data. |
33 |
CVE-2013-4264 |
119 |
|
DoS Overflow |
2013-11-23 |
2016-12-02 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
The kempf_decode_tile function in libavcodec/g2meet.c in FFmpeg before 2.0.1 allows remote attackers to cause a denial of service (out-of-bounds heap write) via a G2M4 encoded file. |
34 |
CVE-2013-4358 |
|
|
DoS |
2013-12-24 |
2013-12-26 |
5.0 |
None |
Remote |
Low |
Not required |
None |
None |
Partial |
libavcodec/h264.c in FFmpeg before 0.11.4 allows remote attackers to cause a denial of service (crash) via vectors related to alternating bit depths in H.264 data. |
35 |
CVE-2014-9319 |
119 |
|
DoS Overflow |
2014-12-09 |
2016-12-02 |
5.0 |
None |
Remote |
Low |
Not required |
None |
None |
Partial |
The ff_hevc_decode_nal_sps function in libavcodec/hevc_ps.c in FFMpeg before 2.1.6, 2.2.x through 2.3.x, and 2.4.x before 2.4.4 allows remote attackers to cause a denial of service (out-of-bounds access) via a crafted .bit file. |
36 |
CVE-2015-1208 |
191 |
|
+Info |
2018-01-09 |
2018-01-30 |
4.3 |
None |
Remote |
Medium |
Not required |
Partial |
None |
None |
Integer underflow in the mov_read_default function in libavformat/mov.c in FFmpeg before 2.4.6 allows remote attackers to obtain sensitive information from heap and/or stack memory via a crafted MP4 file. |
37 |
CVE-2016-1897 |
200 |
|
+Info |
2016-01-14 |
2018-10-30 |
4.3 |
None |
Remote |
Medium |
Not required |
Partial |
None |
None |
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains the first line of a local file. |
38 |
CVE-2016-1898 |
200 |
|
+Info |
2016-01-14 |
2018-10-30 |
4.3 |
None |
Remote |
Medium |
Not required |
Partial |
None |
None |
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains an arbitrary line of a local file. |
39 |
CVE-2016-2213 |
119 |
|
DoS Overflow |
2016-02-03 |
2016-12-05 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
The jpeg2000_decode_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.8.6 allows remote attackers to cause a denial of service (out-of-bounds array read access) via crafted JPEG 2000 data. |
40 |
CVE-2016-6881 |
399 |
|
DoS |
2016-12-23 |
2016-12-23 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
The zlib_refill function in libavformat/swfdec.c in FFmpeg before 3.1.3 allows remote attackers to cause an infinite loop denial of service via a crafted SWF file. |
41 |
CVE-2016-6920 |
119 |
|
DoS Overflow |
2017-01-23 |
2018-10-09 |
5.0 |
None |
Remote |
Low |
Not required |
None |
None |
Partial |
Heap-based buffer overflow in the decode_block function in libavcodec/exr.c in FFmpeg before 3.1.3 allows remote attackers to cause a denial of service (application crash) via vectors involving tile positions. |
42 |
CVE-2016-7122 |
399 |
|
|
2016-12-23 |
2017-06-30 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
The avi_read_nikon function in libavformat/avidec.c in FFmpeg before 3.1.4 is vulnerable to infinite loop when it decodes an AVI file that has a crafted 'nctg' structure. |
43 |
CVE-2016-7555 |
200 |
|
+Info |
2016-12-23 |
2017-06-30 |
4.3 |
None |
Remote |
Medium |
Not required |
Partial |
None |
None |
The avi_read_header function in libavformat/avidec.c in FFmpeg before 3.1.4 is vulnerable to memory leak when decoding an AVI file that has a crafted "strh" structure. |
44 |
CVE-2016-7562 |
119 |
|
DoS Overflow |
2016-12-23 |
2017-06-30 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
The ff_draw_pc_font function in libavcodec/cga_data.c in FFmpeg before 3.1.4 allows remote attackers to cause a denial of service (buffer overflow) via a crafted AVI file. |
45 |
CVE-2016-7785 |
20 |
|
DoS |
2016-12-23 |
2017-06-30 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
The avi_read_seek function in libavformat/avidec.c in FFmpeg before 3.1.4 allows remote attackers to cause a denial of service (assert fault) via a crafted AVI file. |
46 |
CVE-2016-7905 |
476 |
|
DoS |
2016-12-23 |
2017-06-30 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
The read_gab2_sub function in libavformat/avidec.c in FFmpeg before 3.1.4 allows remote attackers to cause a denial of service (NULL pointer used) via a crafted AVI file. |
47 |
CVE-2016-8595 |
20 |
|
DoS |
2016-12-23 |
2017-01-03 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
The gsm_parse function in libavcodec/gsm_parser.c in FFmpeg before 3.1.5 allows remote attackers to cause a denial of service (assert fault) via a crafted AVI file. |
48 |
CVE-2016-9561 |
399 |
|
DoS |
2016-12-23 |
2016-12-23 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
The che_configure function in libavcodec/aacdec_template.c in FFmpeg before 3.2.1 allows remote attackers to cause a denial of service (allocation of huge memory, and being killed by the OS) via a crafted MOV file. |
49 |
CVE-2017-9608 |
476 |
|
DoS |
2017-12-27 |
2018-01-17 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
The dnxhd decoder in FFmpeg before 3.2.6, and 3.3.x before 3.3.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted mov file. |
50 |
CVE-2017-9993 |
200 |
|
+Info |
2017-06-28 |
2019-01-08 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data. |