CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-2213 – Gentoo Linux Security Advisory 201606-09
https://notcve.org/view.php?id=CVE-2016-2213
03 Feb 2016 — The jpeg2000_decode_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.8.6 allows remote attackers to cause a denial of service (out-of-bounds array read access) via crafted JPEG 2000 data. La función jpeg2000_decode_tile en libavcodec/jpeg2000dec.c en FFmpeg en versiones anteriores a 2.8.6 permite a atacantes remotos causar una denegación de servicio (acceso a lectura de array fuera de rango) a través de datos JPEG 2000 manipulados. Multiple vulnerabilities have been found in FFmpeg, the worst of... • http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=0aada30510d809bccfd539a90ea37b61188f2cb4 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.5EPSS: 57%CPEs: 84EXPL: 2CVE-2016-1897 – Gentoo Linux Security Advisory 201705-08
https://notcve.org/view.php?id=CVE-2016-1897
15 Jan 2016 — FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains the first line of a local file. FFmpeg 2.x permite a atacantes remotos llevar a cabo ataques de origen cruzado y leer archivos arbitrarios usando el protocolo concat en un archivo HTTP Live Streaming (HLS) M3U8, dando lugar a una petición HTTP externa en la que la cadena URL con... • http://habrahabr.ru/company/mailru/blog/274855 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.5EPSS: 33%CPEs: 84EXPL: 1CVE-2016-1898 – Gentoo Linux Security Advisory 201705-08
https://notcve.org/view.php?id=CVE-2016-1898
15 Jan 2016 — FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains an arbitrary line of a local file. FFmpeg 2.x permite a atacantes remotos llevar a cabo ataques de origen cruzado y leer archivos arbitrarios usando el protocolo subfile en un archivo HTTP Live Streaming (HLS) M3U8, dando lugar a una petición HTTP externa en la que la cadena UR... • http://habrahabr.ru/company/mailru/blog/274855 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.3EPSS: 0%CPEs: 1EXPL: 0CVE-2015-8661
https://notcve.org/view.php?id=CVE-2015-8661
24 Dec 2015 — The h264_slice_header_init function in libavcodec/h264_slice.c in FFmpeg before 2.8.3 does not validate the relationship between the number of threads and the number of slices, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted H.264 data. La función h264_slice_header_init en libavcodec/h264_slice.c en FFmpeg en versiones anteriores a la 2.8.3 no valida la relación entre el número de hilos y el número de fracciones, l... • http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=4ea4d2f438c9a7eba37980c9a87be4b34943e4d5 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2015-8662
https://notcve.org/view.php?id=CVE-2015-8662
24 Dec 2015 — The ff_dwt_decode function in libavcodec/jpeg2000dwt.c in FFmpeg before 2.8.4 does not validate the number of decomposition levels before proceeding with Discrete Wavelet Transform decoding, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG 2000 data. La función ff_dwt_decode en libavcodec/jpeg2000dwt.c en FFmpeg en versiones anteriores a la 2.8.4 no valida el número de niveles de descomposición antes de procede... • http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=75422280fbcdfbe9dc56bde5525b4d8b280f1bc5 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2015-8216
https://notcve.org/view.php?id=CVE-2015-8216
17 Nov 2015 — The ljpeg_decode_yuv_scan function in libavcodec/mjpegdec.c in FFmpeg before 2.8.2 omits certain width and height checks, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted MJPEG data. La función ljpeg_decode_yuv_scan en libavcodec/mjpegdec.c en FFmpeg en versiones anteriores a 2.8.2 omite cierta comprobación de anchura y altura, lo que permite a atacantes remotos causar una denegación de servicio (acceso fuera de ran... • http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=d24888ef19ba38b787b11d1ee091a3d94920c76a • CWE-17: DEPRECATED: Code •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2015-8217
https://notcve.org/view.php?id=CVE-2015-8217
17 Nov 2015 — The ff_hevc_parse_sps function in libavcodec/hevc_ps.c in FFmpeg before 2.8.2 does not validate the Chroma Format Indicator, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted High Efficiency Video Coding (HEVC) data. La función ff_hevc_parse_sps en libavcodec/hevc_ps.c en FFmpeg en versiones anteriores a 2.8.2 no valida el Chroma Format Indicator, lo que permite a atacantes remotos causar una denegación de servicio (... • http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=93f30f825c08477fe8f76be00539e96014cc83c8 • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2015-8218
https://notcve.org/view.php?id=CVE-2015-8218
17 Nov 2015 — The decode_uncompressed function in libavcodec/faxcompr.c in FFmpeg before 2.8.2 does not validate uncompressed runs, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted CCITT FAX data. La función decode_uncompressed en libavcodec/faxcompr.c en FFmpeg en versiones anteriores a 2.8.2 no valida ejecuciones descomprimidas, lo que permite a atacantes remotos causar una denegación de servicio (acceso fuera de rango al array... • http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=d4a731b84a08f0f3839eaaaf82e97d8d9c67da46 • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2015-8219
https://notcve.org/view.php?id=CVE-2015-8219
17 Nov 2015 — The init_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.8.2 does not enforce minimum-value and maximum-value constraints on tile coordinates, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG 2000 data. La función init_tile en libavcodec/jpeg2000dec.c en FFmpeg en versiones anteriores a 2.8.2 no hace cumplir las restricciones de valor mínimo y valor máximo en las coordenadas del recuadro, lo que pe... • http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=43492ff3ab68a343c1264801baa1d5a02de10167 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 1%CPEs: 2EXPL: 0CVE-2015-6761 – chromium-browser: Memory corruption in FFMpeg
https://notcve.org/view.php?id=CVE-2015-6761
15 Oct 2015 — The update_dimensions function in libavcodec/vp8.c in FFmpeg through 2.8.1, as used in Google Chrome before 46.0.2490.71 and other products, relies on a coefficient-partition count during multi-threaded operation, which allows remote attackers to cause a denial of service (race condition and memory corruption) or possibly have unspecified other impact via a crafted WebM file. La función update_dimensions en libavcodec/vp8.c en FFmpeg hasta la versión 2.8.1, como se utiliza en Google Chrome en versiones ante... • http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=dabea74d0e82ea80cd344f630497cafcb3ef872c • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •