CVE-2014-2097

2014-03-0204:57:25

CWE-20

[email protected]

web.nvd.nist.gov

information security

cve-2014-2097

libavcodec

tak_decode_frame

denial of service

out-of-bounds array access

tak

ffmpeg

nvd

8.9 High

AI Score

Confidence

High

6.8 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.003 Low

EPSS

Percentile

69.3%

JSON

The tak_decode_frame function in libavcodec/takdec.c in FFmpeg before 2.1.4 does not properly validate a certain bits-per-sample value, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted TAK (aka Tom’s lossless Audio Kompressor) data.

Affected configurations

NVD

Node

ffmpegffmpegRange≤2.1.3

ffmpegffmpegMatch2.0

ffmpegffmpegMatch2.0.1

ffmpegffmpegMatch2.0.2

ffmpegffmpegMatch2.0.3

ffmpegffmpegMatch2.1

ffmpegffmpegMatch2.1.1

ffmpegffmpegMatch2.1.2

CPENameOperatorVersion
ffmpeg:ffmpegffmpegle2.1.3
ffmpeg:ffmpegffmpegeq2.0
ffmpeg:ffmpegffmpegeq2.0.1
ffmpeg:ffmpegffmpegeq2.0.2
ffmpeg:ffmpegffmpegeq2.0.3
ffmpeg:ffmpegffmpegeq2.1
ffmpeg:ffmpegffmpegeq2.1.1
ffmpeg:ffmpegffmpegeq2.1.2

CPE	Name	Operator	Version
ffmpeg:ffmpeg	ffmpeg	le	2.1.3
ffmpeg:ffmpeg	ffmpeg	eq	2.0
ffmpeg:ffmpeg	ffmpeg	eq	2.0.1
ffmpeg:ffmpeg	ffmpeg	eq	2.0.2
ffmpeg:ffmpeg	ffmpeg	eq	2.0.3
ffmpeg:ffmpeg	ffmpeg	eq	2.1
ffmpeg:ffmpeg	ffmpeg	eq	2.1.1
ffmpeg:ffmpeg	ffmpeg	eq	2.1.2