Out-of-bounds

The rpzadecodestream function in libavcodec/rpza.c in FFmpeg before 2.1 does not properly maintain a pointer to pixel data, which allows remote attackers to cause a denial of service out-of-bounds array access or possibly have unspecified other impact via crafted Apple RPZA data...

CVE-2013-7008

The decodesliceheader function in libavcodec/h264.c in FFmpeg before 2.1 incorrectly relies on a certain droppable field, which allows remote attackers to cause a denial of service deadlock or possibly have unspecified other impact via crafted H.264 data...

Double free

Double free vulnerability in the vp3updatethreadcontext function in libavcodec/vp3.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact via crafted vp3 data...

CVE-2011-3934

Double free vulnerability in the vp3updatethreadcontext function in libavcodec/vp3.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact via crafted vp3 data...

CVE-2013-7010

Multiple integer signedness errors in libavcodec/dsputil.c in FFmpeg before 2.1 allow remote attackers to cause a denial of service out-of-bounds array access or possibly have unspecified other impact via crafted data...

CVE-2013-7010

Multiple integer signedness errors in libavcodec/dsputil.c in FFmpeg before 2.1 allow remote attackers to cause a denial of service out-of-bounds array access or possibly have unspecified other impact via crafted data...

CVE-2011-3934

CVE-2011-3934 is a double-free vulnerability in FFmpeg’s libavcodec/vp3.c (vp3_update_thread_context) that affects FFmpeg before 0.10, enabling a remote attacker to cause an unspecified impact via crafted vp3 data. Connected advisories (e.g., Debian DSA-3003-1, Gentoo GLSA 201502-08) group this w...

CVE-2013-7023

The ffcombineframe function in libavcodec/parser.c in FFmpeg before 2.1 does not properly handle certain memory-allocation errors, which allows remote attackers to cause a denial of service out-of-bounds array access or possibly have unspecified other impact via crafted data...

CVE-2013-7011

The readheader function in libavcodec/ffv1dec.c in FFmpeg before 2.1 does not prevent changes to global parameters, which allows remote attackers to cause a denial of service out-of-bounds array access or possibly have unspecified other impact via crafted FFV1 data...

CVE-2013-7022

FFmpeg, pre-2.1, is affected by CVE-2013-7022 via g2m_init_buffers in libavcodec/g2meet.c: memory for tiles is not allocated correctly, allowing a remote attacker to trigger a denial of service through an out-of-bounds access in crafted Go2Webinar data. The issue’s impact is described as DoS and ...

CVE-2013-7021

The filterframe function in libavfilter/vffps.c in FFmpeg before 2.1 does not properly ensure the availability of FIFO content, which allows remote attackers to cause a denial of service double free or possibly have unspecified other impact via crafted data...

DEBIAN-CVE-2013-0846

Array index error in the qdm2decodesuperblock function in libavcodec/qdm2.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via crafted QDM2 data, which triggers an out-of-bounds array access...

DEBIAN-CVE-2013-0844

Off-by-one error in the adpcmdecodeframe function in libavcodec/adpcm.c in FFmpeg before 1.0.4 allows remote attackers to have an unspecified impact via crafted DK4 data, which triggers an out-of-bounds array access...

CVE-2013-0848

The decodeinit function in libavcodec/huffyuv.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via a crafted width in huffyuv data with the predictor set to median and the colorspace set to YUV422P, which triggers an out-of-bounds array access...

CVE-2013-0877

The oldcodec37 function in libavcodec/sanm.c in FFmpeg before 1.1.3 allows remote attackers to have an unspecified impact via crafted LucasArts Smush data that has a large size when decoded, related to an out-of-bounds array access...

CVE-2013-0878

The advanceline function in libavcodec/targa.c in FFmpeg before 1.1.3 allows remote attackers to have an unspecified impact via crafted Targa image data, related to an out-of-bounds array access...

Updated icu packages fix CVE-2013-2924

Updated icu packages fix security vulnerability: It was discovered that ICU incorrectly handled memory operations. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program...

USN-1989-1: ICU vulnerabilities

It was discovered that ICU contained a race condition affecting multi- threaded applications. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program. This issue only affecte...

CVE-2013-5664

Cross-site scripting XSS vulnerability in the web-based device-management API browser in Palo Alto Networks PAN-OS before 4.1.13 and 5.0.x before 5.0.6 allows remote attackers to inject arbitrary web script or HTML via crafted data, aka Ref ID 50908...

Cross site scripting

Cross-site scripting XSS vulnerability in the web-based device-management API browser in Palo Alto Networks PAN-OS before 4.1.13 and 5.0.x before 5.0.6 allows remote attackers to inject arbitrary web script or HTML via crafted data, aka Ref ID 50908...