CVE-2013-7013

The g2minitbuffers function in libavcodec/g2meet.c in FFmpeg before 2.1 uses an incorrect ordering of arithmetic operations, which allows remote attackers to cause a denial of service out-of-bounds array access or possibly have unspecified other impact via crafted Go2Webinar data...

CVE-2011-4351

FFmpeg did suffer a buffer overflow vulnerability (CVE-2011-4351) that could allow remote code execution via unspecified vectors. Public advisories list affected releases as FFmpeg before 0.5.6, 0.6.x before 0.6.4, 0.7.x before 0.7.8, and 0.8.x before 0.8.8. The issue is not described beyond a bu...

CVE-2013-7016

CVE-2013-7016 affects FFmpeg up to version 2.1, where get_siz in libavcodec/jpeg2000dec.c may fail to enforce expected sample separation when processing JPEG2000 data. This can lead to an out-of-bounds array access and remote denial of service, with potential unspecified impact. The issue arises ...

CVE-2013-7017

libavcodec/jpeg2000.c in FFmpeg before 2.1 allows remote attackers to cause a denial of service invalid pointer dereference or possibly have unspecified other impact via crafted JPEG2000 data...

CVE-2011-3941

FFmpeg vulnerability CVE-2011-3941: The decode_mb function in libavcodec/error_resilience.c enables an out-of-bounds write due to an uninitialized block index in FFmpeg before version 0.10. The issue is triggered by processing certain streams, with the CVE description noting an unspecified impact...

CVE-2011-3949

CVE-2011-3949 affects FFmpeg: the dirac_unpack_idwt_params function in libavcodec/diracdec.c (FFmpeg prior to 0.10) can be triggered by crafted Dirac data to cause an unspecified impact. The connected advisories reiterate the exact description and note that remediation involves upgrading FFmpeg. ...

CVE-2013-7009

The rpzadecodestream function in libavcodec/rpza.c in FFmpeg before 2.1 does not properly maintain a pointer to pixel data, which allows remote attackers to cause a denial of service out-of-bounds array access or possibly have unspecified other impact via crafted Apple RPZA data...

CVE-2011-3946

The ffh264decodesei function in libavcodec/h264sei.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact via crafted Supplemental enhancement information SEI data, which triggers an infinite loop...

CVE-2013-7023

The ffcombineframe function in libavcodec/parser.c in FFmpeg before 2.1 does not properly handle certain memory-allocation errors, which allows remote attackers to cause a denial of service out-of-bounds array access or possibly have unspecified other impact via crafted data...

CVE-2013-7017

libavcodec/jpeg2000.c in FFmpeg before 2.1 allows remote attackers to cause a denial of service invalid pointer dereference or possibly have unspecified other impact via crafted JPEG2000 data...

CVE-2011-3941

The decodemb function in libavcodec/errorresilience.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact via vectors related to an uninitialized block index, which triggers an out-of-bounds write...

CVE-2013-7012

The getsiz function in libavcodec/jpeg2000dec.c in FFmpeg before 2.1 does not prevent attempts to use non-zero image offsets, which allows remote attackers to cause a denial of service out-of-bounds array access or possibly have unspecified other impact via crafted JPEG2000 data...

CVE-2013-7020

FFmpeg/libav is affected by CVE-2013-7020 due to improper enforcement of bit-count/colorspace constraints in read_header (FFV1 decoding), allowing an out-of-bounds read and potential DoS. Connected advisories (Debian DSA-3027-1, Gentoo GLSA 201603-06, Mandriva MDVSA-2014:227) confirm FFV1-related...

CVE-2011-3946

FFmpeg vulnerability CVE-2011-3946: The ff_h264_decode_sei function in libavcodec/h264_sei.c in FFmpeg before 0.10 can be triggered by crafted SEI data to cause an infinite loop, leading to potential denial of service. Affected product: FFmpeg (libavcodec/h264_sei.c). Root cause: improper handlin...

CVE-2013-7011

The CVE-2013-7011 issue affects FFmpeg’s read_header in libavcodec/ffv1dec.c, where global parameters can be changed by crafted FFV1 data, enabling a remote attacker to trigger a DoS via out-of-bounds access. Affected: FFmpeg builds prior to 2.1. Root cause: improper validation of global paramete...

CVE-2011-3934

CVE-2011-3934 is a double-free vulnerability in FFmpeg’s libavcodec/vp3.c (vp3_update_thread_context) that affects FFmpeg before 0.10, enabling a remote attacker to cause an unspecified impact via crafted vp3 data. Connected advisories (e.g., Debian DSA-3003-1, Gentoo GLSA 201502-08) group this w...

CVE-2011-3949

The diracunpackidwtparams function in libavcodec/diracdec.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact via crafted Dirac data...

CVE-2013-7016

The getsiz function in libavcodec/jpeg2000dec.c in FFmpeg before 2.1 does not ensure the expected sample separation, which allows remote attackers to cause a denial of service out-of-bounds array access or possibly have unspecified other impact via crafted JPEG2000 data...

CVE-2013-7019

The getcox function in libavcodec/jpeg2000dec.c in FFmpeg before 2.1 does not properly validate the reduction factor, which allows remote attackers to cause a denial of service out-of-bounds array access or possibly have unspecified other impact via crafted JPEG2000 data...

CVE-2013-7023

The ffcombineframe function in libavcodec/parser.c in FFmpeg before 2.1 does not properly handle certain memory-allocation errors, which allows remote attackers to cause a denial of service out-of-bounds array access or possibly have unspecified other impact via crafted data...