FFmpeg vulnerabilities

The read_header function in libavcodec/ffv1dec.c in FFmpeg 2.4 and 3.3.4 and possibly earlier allows remote attackers to have unspecified impact via a crafted MP4 file, which triggers an out-of-bounds read.

The sdp_parse_fmtp_config_h264 function in libavformat/rtpdec_h264.c in FFmpeg before version 3.3.4 mishandles empty sprop-parameter-sets values, allowing remote attackers to cause a denial of service (heap buffer overflow) or possibly have unspecified other impact via a crafted sdp file.

The av_color_primaries_name function in libavutil/pixdesc.c in FFmpeg 3.3.3 may return a NULL pointer depending on a value contained in a file, leading to a NULL pointer dereference in the avcodec_string function in libavcodec/utils.c.

Unspecified vulnerability in FFMPEG 0.10 allows remote attackers to cause a denial of service.

The dnxhd_decode_header function in libavcodec/dnxhddec.c in FFmpeg versions 3.0 through 3.3.2 allows remote attackers to cause a denial of service (out-of-array access) or possibly have unspecified other impact via a crafted DNxHD file.

The ff_amf_get_field_value function in libavformat/rtmppkt.c in FFmpeg 3.3.2 allows remote RTMP servers to cause a denial of service via a crafted stream, leading to segmentation violation and application crash.

The cdxl_decode_frame function in libavcodec/cdxl.c in FFmpeg before versions 2.8.12, 3.0.8, 3.1.8, 3.2.5, and 3.3.1 does not exclude the CHUNKY format, allowing remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.

In libavcodec/scpr.c in FFmpeg version 3.3 and earlier, before version 3.3.1, height and width data is not properly validated, allowing remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.

FFmpeg versions before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 do not properly restrict HTTP Live Streaming filename extensions and demuxer names, allowing attackers to read arbitrary files via crafted playlist data.

A heap-based buffer overflow in the decode_dds1 function in libavcodec/dfa.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file.

A heap-based buffer overflow in the xwd_decode_frame function in FFmpeg before 2.8.12 and 3.0.x before 3.0.8 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file.

Heap-based buffer overflow in the decode_block function in libavcodec/exr.c in FFmpeg before 3.1.3 allows remote attackers to cause an application crash.

The cavs_idct8_add_c function in libavcodec/cavsdsp.c in FFmpeg before version 3.1.4 is vulnerable to reading out-of-bounds memory when decoding with cavs_decode.

The ff_log2_16bit_c function in libavutil/intmath.h in FFmpeg before version 3.1.4 is vulnerable to reading out-of-bounds memory when decoding a malformed AIFF file.

The raw_decode function in libavcodec/rawdec.c in FFmpeg before 3.1.2 allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a crafted SWF file.

In libavcodec/gif.c in FFmpeg before version 2.8.6, the buffer size is not properly calculated, allowing remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted .tga file.

In libavcodec/tiff.c in FFmpeg before version 2.8.6, RowsPerStrip values and YCbCr chrominance subsampling factors are not properly validated. This allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted TIFF file.

In the libswscale library in FFmpeg before version 2.8.6, certain height values are not validated, allowing remote attackers to cause a denial of service (out-of-bounds array read access) or possibly have unspecified other impact via a crafted .cine file.

The libavcodec/pngenc.c in FFmpeg before version 2.8.5 has a flaw in line size calculations, which may lead to out-of-bounds array access. Remote attackers can exploit this vulnerability by sending a crafted .avi file.

Integer overflow in the asf_write_packet function in FFmpeg before version 2.8.5 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PTS value in a .mov file.

The ff_get_buffer function in libavcodec/utils.c in FFmpeg before version 2.8.4 preserves width and height values after a failure, allowing remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted .mov file.

The ff_dwt_decode function in libavcodec/jpeg2000dwt.c in FFmpeg before version 2.8.4 does not validate the number of decomposition levels before proceeding with Discrete Wavelet Transform decoding, which may lead to denial of service or other unspecified impacts.

The h264_slice_header_init function in libavcodec/h264_slice.c in FFmpeg before version 2.8.3 does not validate the relationship between the number of threads and the number of slices, which may lead to denial of service (out-of-bounds array access) or potentially other unspecified impacts via crafted H.264 data.

The init_tile function in libavcodec/jpeg2000dec.c in FFmpeg before version 2.8.2 does not enforce minimum and maximum value constraints on tile coordinates, allowing remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG 2000 data.

The ff_hevc_parse_sps function in libavcodec/hevc_ps.c in FFmpeg before 2.8.2 does not validate the Chroma Format Indicator, allowing remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted HEVC data.

The ljpeg_decode_yuv_scan function in libavcodec/mjpegdec.c in FFmpeg before version 2.8.2 omits certain width and height checks, allowing remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted MJPEG data.

The ff_frame_thread_init function in libavcodec/pthread_frame.c in FFmpeg before version 2.7.2 mishandles certain memory-allocation failures, allowing remote attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via a crafted file, as demonstrated by an AVI file.

The sws_init_context function in libswscale/utils.c in FFmpeg before version 2.7.2 does not initialize certain pixbuf data structures, allowing remote attackers to cause a denial of service (segmentation violation) or possibly have unspecified other impact via crafted video data.

The allocate_buffers function in libavcodec/alac.c in FFmpeg before version 2.7.2 does not initialize certain context data, allowing remote attackers to cause a denial of service (segmentation violation) or possibly have unspecified other impact via crafted Apple Lossless Audio Codec (ALAC) data.

The destroy_buffers function in libavcodec/sanm.c in FFmpeg before version 2.7.2 does not properly maintain height and width values in the video context, allowing remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via crafted LucasArts Smush video data.

The ff_mpv_common_init function in libavcodec/mpegvideo.c in FFmpeg before 2.7.2 does not properly maintain the encoding context, allowing remote attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via crafted MPEG data.

The ff_sbr_apply function in libavcodec/aacsbr.c in FFmpeg before version 2.7.2 does not check for a matching AAC frame syntax element before proceeding with Spectral Band Replication calculations. This allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted AAC data.

Multiple integer underflows in the ff_mjpeg_decode_frame function in libavcodec/mjpegdec.c in FFmpeg before version 2.7.2 allow remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted MJPEG data.

The decode_ihdr_chunk function in libavcodec/pngdec.c in FFmpeg before version 2.7.2 does not enforce uniqueness of the IHDR (image header) chunk in a PNG image, allowing remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted image with two or more of these chunks.

In the libavcodec/utvideodec.c file in FFmpeg before version 2.5.2, there is no check for a zero value of slice height, allowing remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Ut Video data.

The vmd_decode function in libavcodec/vmdvideo.c in FFmpeg before 2.5.2 does not validate the relationship between a certain length value and the frame width, allowing remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Sierra VMD video data.

In libavcodec/xface.h in FFmpeg before version 2.5.2, there is an issue with the dimensions of certain digits and words arrays that do not satisfy a required mathematical relationship. This allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted X-Face image data.

The raw_decode function in libavcodec/rawdec.c in FFMpeg before 2.1.6, and in versions 2.2.x through 2.3.x and 2.4.x before 2.4.4 allows remote attackers to cause a denial of service (out-of-bounds heap access) via a crafted .cine file, potentially leading to other unspecified impacts.

The decode_ihdr_chunk function in libavcodec/pngdec.c in FFMpeg before 2.1.6, 2.2.x through 2.3.x, and 2.4.x before 2.4.4 allows remote attackers to cause a denial of service (out-of-bounds heap access) and possibly have other unspecified impact via an IDAT before an IHDR in a PNG file.

In the libavcodec library in FFmpeg before version 2.4.2, the number of channels is not constrained to at most 2, allowing remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted On2 data.

An off-by-one error in libavcodec/smc.c in FFmpeg before version 2.4.2 allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted Quicktime Graphics (SMC) video data.

In libavcodec/gifdec.c in FFmpeg before version 2.4.2, image heights are not properly computed, allowing remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted GIF data.

In libavcodec/pngdec.c in FFmpeg before version 2.4.2, the monochrome-black format is accepted without verifying that the bits-per-pixel value is 1. This allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted PNG data.

In libavcodec/tiff.c in FFmpeg before version 2.4.2, bits-per-pixel fields are not properly validated, allowing remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted TIFF data.

In libavcodec in FFmpeg before version 2.4.2, a certain codec ID is omitted during alignment enforcement, allowing remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted JV data.

In libavcodec/mjpegdec.c in FFmpeg before version 2.4.2, only dimension differences are considered when determining whether an image size has changed, not bits-per-pixel differences. This allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted MJPEG data.

FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). The librist_read() function ignores its size argument and copies the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload.

The 'vp3_decode_frame' function in FFmpeg 1.1.4 moves threads check out of header packet type check, which may lead to improper data processing.

Unspecified vulnerability in FFmpeg before version 0.10.3 with unknown impact and attack vectors. This is a different vulnerability than CVE-2012-2771, CVE-2012-2773, CVE-2012-2778, and CVE-2012-2780.

Unspecified vulnerability in FFmpeg before version 0.10.3, with unknown impact and attack vectors. This is a different vulnerability than CVE-2012-2771, CVE-2012-2773, CVE-2012-2778, and CVE-2012-2781.