U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

Search Results (Refine Search)

Search Parameters:
  • CPE Product Version: cpe:/a:ffmpeg:ffmpeg:1.0.5
There are 153 matching records.
Displaying matches 141 through 153.
Vuln ID Summary CVSS Severity
CVE-2013-0873

The read_header function in libavcodec/shorten.c in FFmpeg before 1.1.3 allows remote attackers to have an unspecified impact via an invalid channel count, related to "freeing invalid addresses."

Published: November 23, 2013; 12:55:03 PM -0500
V3.x:(not available)
V2.0: 10.0 HIGH
CVE-2013-0872

The swr_init function in libswresample/swresample.c in FFmpeg before 1.1.3 allows remote attackers to have an unspecified impact via an invalid or unsupported (1) input or (2) output channel layout, related to an out-of-bounds array access.

Published: November 23, 2013; 12:55:03 PM -0500
V3.x:(not available)
V2.0: 10.0 HIGH
CVE-2013-3675

The process_frame_obj function in sanm.c in libavcodec in FFmpeg before 1.2.1 does not validate width and height values, which allows remote attackers to cause a denial of service (integer overflow, out-of-bounds array access, and application crash) via crafted LucasArts Smush video data.

Published: June 09, 2013; 11:19:55 PM -0400
V3.x:(not available)
V2.0: 4.3 MEDIUM
CVE-2013-3674

The cdg_decode_frame function in cdgraphics.c in libavcodec in FFmpeg before 1.2.1 does not validate the presence of non-header data in a buffer, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted CD Graphics Video data.

Published: June 09, 2013; 11:19:55 PM -0400
V3.x:(not available)
V2.0: 4.3 MEDIUM
CVE-2013-3673

The gif_decode_frame function in gifdec.c in libavcodec in FFmpeg before 1.2.1 does not properly manage the disposal methods of frames, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted GIF data.

Published: June 09, 2013; 11:19:55 PM -0400
V3.x:(not available)
V2.0: 4.3 MEDIUM
CVE-2013-3672

The mm_decode_inter function in mmvideo.c in libavcodec in FFmpeg before 1.2.1 does not validate the relationship between a horizontal coordinate and a width value, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted American Laser Games (ALG) MM Video data.

Published: June 09, 2013; 11:19:54 PM -0400
V3.x:(not available)
V2.0: 4.3 MEDIUM
CVE-2013-3671

The format_line function in log.c in libavutil in FFmpeg before 1.2.1 uses inapplicable offset data during a certain category calculation, which allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via crafted data that triggers a log message.

Published: June 09, 2013; 11:19:54 PM -0400
V3.x:(not available)
V2.0: 4.3 MEDIUM
CVE-2013-3670

The rle_unpack function in vmdav.c in libavcodec in FFmpeg git 20130328 through 20130501 does not properly use the bytestream2 API, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted RLE data. NOTE: the vendor has listed this as an issue fixed in 1.2.1, but the issue is actually in new code that was not shipped with the 1.2.1 release or any earlier release.

Published: June 09, 2013; 11:19:54 PM -0400
V3.x:(not available)
V2.0: 4.3 MEDIUM
CVE-2013-2496

The msrle_decode_8_16_24_32 function in msrledec.c in libavcodec in FFmpeg through 1.1.3 does not properly determine certain end pointers, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via crafted Microsoft RLE data.

Published: March 09, 2013; 6:55:01 AM -0500
V3.x:(not available)
V2.0: 7.5 HIGH
CVE-2013-2495

The iff_read_header function in iff.c in libavformat in FFmpeg through 1.1.3 does not properly handle data sizes for Interchange File Format (IFF) data during operations involving a CMAP chunk or a video codec, which allows remote attackers to cause a denial of service (integer overflow, out-of-bounds array access, and application crash) or possibly have unspecified other impact via a crafted header.

Published: March 09, 2013; 6:55:01 AM -0500
V3.x:(not available)
V2.0: 7.5 HIGH
CVE-2013-2277

The ff_h264_decode_seq_parameter_set function in h264_ps.c in libavcodec in FFmpeg before 1.1.3 does not validate the relationship between luma depth and chroma depth, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via crafted H.264 data.

Published: February 27, 2013; 11:55:02 AM -0500
V3.x:(not available)
V2.0: 7.5 HIGH
CVE-2013-2276

The avcodec_decode_audio4 function in utils.c in libavcodec in FFmpeg before 1.1.3 does not verify the decoding state before proceeding with certain skip operations, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via crafted audio data.

Published: February 27, 2013; 11:55:02 AM -0500
V3.x:(not available)
V2.0: 7.5 HIGH
CVE-2013-0894

Buffer overflow in the vorbis_parse_setup_hdr_floors function in the Vorbis decoder in vorbisdec.c in libavcodec in FFmpeg through 1.1.3, as used in Google Chrome before 25.0.1364.97 on Windows and Linux and before 25.0.1364.99 on Mac OS X and other products, allows remote attackers to cause a denial of service (divide-by-zero error or out-of-bounds array access) or possibly have unspecified other impact via vectors involving a zero value for a bark map size.

Published: February 23, 2013; 4:55:01 PM -0500
V3.x:(not available)
V2.0: 7.5 HIGH