CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2014-125003 – FFmpeg jpeg2000dec.c get_siz memory corruption
https://notcve.org/view.php?id=CVE-2014-125003
A vulnerability was found in FFmpeg 2.0 and classified as problematic. This issue affects the function get_siz of the file libavcodec/jpeg2000dec.c. The manipulation leads to memory corruption. The attack may be initiated remotely. It is recommended to apply a patch to fix this issue. • http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=8001e9f7d17e90b4b0898ba64e3b8bbd716c513c https://vuldb.com/?id.12587 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-787: Out-of-bounds Write •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2014-125002 – FFmpeg dnxhdenc.c dnxhd_init_rc memory corruption
https://notcve.org/view.php?id=CVE-2014-125002
A vulnerability was found in FFmpeg 2.0. It has been classified as problematic. Affected is the function dnxhd_init_rc of the file libavcodec/dnxhdenc.c. The manipulation leads to memory corruption. It is possible to launch the attack remotely. • http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=f1caaa1c61310beba705957e6366f0392a0b005b https://vuldb.com/?id.12588 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 7EXPL: 1CVE-2021-38291
https://notcve.org/view.php?id=CVE-2021-38291
FFmpeg version (git commit de8e6e67e7523e48bb27ac224a0b446df05e1640) suffers from a an assertion failure at src/libavutil/mathematics.c. Una versión de FFmpeg (git commit de8e6e67e7523e48bb27ac224a0b446df05e1640) sufre un fallo de aserción en el archivo src/libavutil/mathematics.c • https://lists.debian.org/debian-lts-announce/2021/11/msg00012.html https://security.gentoo.org/glsa/202312-14 https://trac.ffmpeg.org/ticket/9312 https://www.debian.org/security/2021/dsa-4990 https://www.debian.org/security/2021/dsa-4998 • CWE-617: Reachable Assertion •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-3566
https://notcve.org/view.php?id=CVE-2021-3566
Prior to ffmpeg version 4.3, the tty demuxer did not have a 'read_probe' function assigned to it. By crafting a legitimate "ffconcat" file that references an image, followed by a file the triggers the tty demuxer, the contents of the second file will be copied into the output file verbatim (as long as the `-vcodec copy` option is passed to ffmpeg). Anterior a versión 4.3 de ffmpeg, el demuxer tty no tenía una función "read_probe" asignada. Si se diseña un archivo "ffconcat" legítimo que haga referencia a una imagen, seguido de un archivo que desencadenar el demuxer tty, el contenido del segundo archivo se copiará en el archivo de salida literalmente (siempre que se pase la opción "vcodec copy" a ffmpeg) • https://github.com/FFmpeg/FFmpeg/commit/3bce9e9b3ea35c54bacccc793d7da99ea5157532#diff-74f6b92a0541378ad15de9c29c0a2b0c69881ad9ffc71abe568b88b535e00a7f https://lists.debian.org/debian-lts-announce/2021/08/msg00018.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 3CVE-2020-24995
https://notcve.org/view.php?id=CVE-2020-24995
Buffer overflow vulnerability in sniff_channel_order function in aacdec_template.c in ffmpeg 3.1.2, allows attackers to execute arbitrary code (local). Una vulnerabilidad de desbordamiento del búfer en la función sniff_channel_order en el archivo aacdec_template.c en ffmpeg versión 3.1.2, permite a atacantes ejecutar código arbitrario (local). • http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=d6f293353c94c7ce200f6e0975ae3de49787f91f https://trac.ffmpeg.org/ticket/8845 https://trac.ffmpeg.org/ticket/8859 https://trac.ffmpeg.org/ticket/8860 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •