CVE-2013-7020

FFmpeg/libav is affected by CVE-2013-7020 due to improper enforcement of bit-count/colorspace constraints in read_header (FFV1 decoding), allowing an out-of-bounds read and potential DoS. Connected advisories (Debian DSA-3027-1, Gentoo GLSA 201603-06, Mandriva MDVSA-2014:227) confirm FFV1-related...

CVE-2013-7009

FFmpeg: CVE-2013-7009 affects the rpza_decode_stream function in libavcodec/rpza.c, where improper maintenance of the pixel data pointer in FFmpeg before 2.1 can cause out-of-bounds access and a denial-of-service via crafted Apple RPZA data. Exploitation is remote and depends on parsing RPZA data...

CVE-2013-7013

CVE-2013-7013 affects FFmpeg’s g2m_init_buffers in libavcodec/g2meet.c, where an incorrect arithmetic operation order in the Go2Webinar path (pre-2.1) enables out-of-bounds memory access and DoS via crafted data. The vulnerability is documented across multiple advisories (NVD/Nessus/Gentoo GLSA) ...

CVE-2013-7018

FFmpeg vulnerable component: libavcodec/jpeg2000dec.c in FFmpeg prior to 2.1. The issue allows remote attackers to trigger a denial of service via out-of-bounds array access when processing crafted JPEG2000 data due to invalid code-block dimension values. Impact includes DoS (and possibly other u...

CVE-2011-3949

CVE-2011-3949 affects FFmpeg: the dirac_unpack_idwt_params function in libavcodec/diracdec.c (FFmpeg prior to 0.10) can be triggered by crafted Dirac data to cause an unspecified impact. The connected advisories reiterate the exact description and note that remediation involves upgrading FFmpeg. ...

CVE-2013-7019

CVE-2013-7019 affects FFmpeg up to version 2.1, where get_cox in libavcodec/jpeg2000dec.c fails to validate the reduction factor, enabling an out-of-bounds access in crafted JPEG2000 data and potentially causing a denial of service or other impact. The issue is documented across multiple feeds (N...

CVE-2013-7024

CVE-2013-7024 affects FFmpeg’s FFmpeg libavcodec JPEG2000 decoding: the function jpeg2000_decode_tile in libavcodec/jpeg2000dec.c does not properly account for the component number in certain calculations, allowing a remote attacker to trigger a denial-of-service via out-of-bounds array access or...

CVE-2013-7012

Vulnerability (CVE-2013-7012) in FFmpeg affects the get_siz function in libavcodec/jpeg2000dec.c. FFmpeg versions before 2.1 do not prevent use of non-zero image offsets, enabling a remote attacker to cause a denial of service via out-of-bounds array access when processing crafted JPEG2000 data. ...

CVE-2013-7011

The CVE-2013-7011 issue affects FFmpeg’s read_header in libavcodec/ffv1dec.c, where global parameters can be changed by crafted FFV1 data, enabling a remote attacker to trigger a DoS via out-of-bounds access. Affected: FFmpeg builds prior to 2.1. Root cause: improper validation of global paramete...

CVE-2013-7008

The CVE-2013-7008 flaw affects FFmpeg’s libavcodec/h264.c decode_slice_header, where the code incorrectly relies on a certain droppable field before FFmpeg 2.1. This enables an attacker to craft H.264 data that may cause a denial of service (deadlock) or other unspecified impact. The public repor...

CVE-2011-3935

CVE-2011-3935 affects FFmpeg (codec_get_buffer in ffmpeg.c) and is listed in Libre/Libav-related advisories. Description states remote, with unspecified impact via a crafted image size in FFmpeg before 0.10; connected OpenVAS/Gentoo/Debian entries reference Libav as affected by multiple vulnerabi...

CVE-2013-7017

FFmpeg vulnerability CVE-2013-7017 involves libavcodec/jpeg2000.c and affects FFmpeg before 2.1, where crafted JPEG2000 data can trigger a remote denial of service (invalid pointer dereference). The issue is corroborated by multiple sources in connected docs, including Gentoo GLSA-201603-06 and r...

CVE-2013-7021

CVE-2013-7021 affects FFmpeg's libavfilter/vf_fps.c (filter_frame). Before 2.1, it fails to properly ensure FIFO content, allowing remote attackers to trigger a denial of service via a double free or potentially other impact with crafted data. Impact: DoS (and possibly unspecified). Remediation: ...

CVE-2013-7016

CVE-2013-7016 affects FFmpeg up to version 2.1, where get_siz in libavcodec/jpeg2000dec.c may fail to enforce expected sample separation when processing JPEG2000 data. This can lead to an out-of-bounds array access and remote denial of service, with potential unspecified impact. The issue arises ...

CVE-2013-7011

The readheader function in libavcodec/ffv1dec.c in FFmpeg before 2.1 does not prevent changes to global parameters, which allows remote attackers to cause a denial of service out-of-bounds array access or possibly have unspecified other impact via crafted FFV1 data...

CVE-2013-7008

The decodesliceheader function in libavcodec/h264.c in FFmpeg before 2.1 incorrectly relies on a certain droppable field, which allows remote attackers to cause a denial of service deadlock or possibly have unspecified other impact via crafted H.264 data...

CVE-2013-7009

The rpzadecodestream function in libavcodec/rpza.c in FFmpeg before 2.1 does not properly maintain a pointer to pixel data, which allows remote attackers to cause a denial of service out-of-bounds array access or possibly have unspecified other impact via crafted Apple RPZA data...

CVE-2013-7016

The getsiz function in libavcodec/jpeg2000dec.c in FFmpeg before 2.1 does not ensure the expected sample separation, which allows remote attackers to cause a denial of service out-of-bounds array access or possibly have unspecified other impact via crafted JPEG2000 data...

CVE-2013-7017

libavcodec/jpeg2000.c in FFmpeg before 2.1 allows remote attackers to cause a denial of service invalid pointer dereference or possibly have unspecified other impact via crafted JPEG2000 data...

CVE-2013-7020

The readheader function in libavcodec/ffv1dec.c in FFmpeg before 2.1 does not properly enforce certain bit-count and colorspace constraints, which allows remote attackers to cause a denial of service out-of-bounds array access or possibly have unspecified other impact via crafted FFV1 data...