SB2014121014 - Multiple vulnerabilities in ffmpeg.sourceforge.net FFmpeg

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2014121014

SB2014121014 - Multiple vulnerabilities in ffmpeg.sourceforge.net FFmpeg

Published: December 10, 2014 Updated: August 9, 2020

Security Bulletin ID SB2014121014
Severity
Medium
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 secuirty vulnerabilities.


1) Buffer overflow (CVE-ID: CVE-2014-9319)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The ff_hevc_decode_nal_sps function in libavcodec/hevc_ps.c in FFMpeg before 2.1.6, 2.2.x through 2.3.x, and 2.4.x before 2.4.4 allows remote attackers to cause a denial of service (out-of-bounds access) via a crafted .bit file.


2) Buffer overflow (CVE-ID: CVE-2014-9318)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The raw_decode function in libavcodec/rawdec.c in FFMpeg before 2.1.6, 2.2.x through 2.3.x, and 2.4.x before 2.4.4 allows remote attackers to cause a denial of service (out-of-bounds heap access) and possibly have other unspecified impact via a crafted .cine file that triggers the avpicture_get_size function to return a negative frame size.


3) Buffer overflow (CVE-ID: CVE-2014-9317)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The decode_ihdr_chunk function in libavcodec/pngdec.c in FFMpeg before 2.1.6, 2.2.x through 2.3.x, and 2.4.x before 2.4.4 allows remote attackers to cause a denial of service (out-of-bounds heap access) and possibly have other unspecified impact via an IDAT before an IHDR in a PNG file.


4) Buffer overflow (CVE-ID: CVE-2014-9316)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The mjpeg_decode_app function in libavcodec/mjpegdec.c in FFMpeg before 2.1.6, 2.2.x through 2.3.x, and 2.4.x before 2.4.4 allows remote attackers to cause a denial of service (out-of-bounds heap access) and possibly have other unspecified impact via vectors related to LJIF tags in an MJPEG file.


Remediation

Install update from vendor's website.

References