CVE-2014-9316

2014-12-0923:59:00

CWE-119

[email protected]

web.nvd.nist.gov

cve-2014-9316

ffmpeg

denial of service

out-of-bounds heap access

mjpeg_decode_app

security vulnerability

8.3 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.006 Low

EPSS

Percentile

78.2%

JSON

The mjpeg_decode_app function in libavcodec/mjpegdec.c in FFMpeg before 2.1.6, 2.2.x through 2.3.x, and 2.4.x before 2.4.4 allows remote attackers to cause a denial of service (out-of-bounds heap access) and possibly have other unspecified impact via vectors related to LJIF tags in an MJPEG file.

CPENameOperatorVersion
ffmpeg:ffmpegffmpegeq2.3
ffmpeg:ffmpegffmpegeq2.3.3
ffmpeg:ffmpegffmpegeq2.2
ffmpeg:ffmpegffmpegeq2.4.1
ffmpeg:ffmpegffmpegeq2.2.4
ffmpeg:ffmpegffmpegeq2.3.5
ffmpeg:ffmpegffmpegeq2.4.3
ffmpeg:ffmpegffmpegeq2.4.2
ffmpeg:ffmpegffmpegeq2.3.2
ffmpeg:ffmpegffmpegle2.1.5

CPE	Name	Operator	Version
ffmpeg:ffmpeg	ffmpeg	eq	2.3
ffmpeg:ffmpeg	ffmpeg	eq	2.3.3
ffmpeg:ffmpeg	ffmpeg	eq	2.2
ffmpeg:ffmpeg	ffmpeg	eq	2.4.1
ffmpeg:ffmpeg	ffmpeg	eq	2.2.4
ffmpeg:ffmpeg	ffmpeg	eq	2.3.5
ffmpeg:ffmpeg	ffmpeg	eq	2.4.3
ffmpeg:ffmpeg	ffmpeg	eq	2.4.2
ffmpeg:ffmpeg	ffmpeg	eq	2.3.2
ffmpeg:ffmpeg	ffmpeg	le	2.1.5