SB2016120711 - Multiple vulnerabilities in FFmpeg

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2016120711

SB2016120711 - Multiple vulnerabilities in FFmpeg

Published: December 7, 2016 Updated: June 8, 2025

Security Bulletin ID SB2016120711
Severity
Medium
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 secuirty vulnerabilities.


1) Input validation error (CVE-ID: CVE-2015-8219)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The init_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.8.2 does not enforce minimum-value and maximum-value constraints on tile coordinates, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG 2000 data.


2) Input validation error (CVE-ID: CVE-2015-8218)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The decode_uncompressed function in libavcodec/faxcompr.c in FFmpeg before 2.8.2 does not validate uncompressed runs, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted CCITT FAX data.


3) Input validation error (CVE-ID: CVE-2015-8217)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The ff_hevc_parse_sps function in libavcodec/hevc_ps.c in FFmpeg before 2.8.2 does not validate the Chroma Format Indicator, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted High Efficiency Video Coding (HEVC) data.


4) Input validation error (CVE-ID: CVE-2015-8216)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The ljpeg_decode_yuv_scan function in libavcodec/mjpegdec.c in FFmpeg before 2.8.2 omits certain width and height checks, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted MJPEG data.


Remediation

Install update from vendor's website.

References