libavcodec/tiff.c in FFmpeg before 2.8.6 does not properly validate RowsPerStrip values and YCbCr chrominance subsampling factors, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted TIFF file, related to the tiff_decode_tag and decode_frame functions.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpeg | Oct 1, 2024 | Feb 12, 2016 |
| Debian | — | Upgrade ffmpeg | Jul 30, 2024 | Feb 12, 2016 |
| Ffmpeg | — | Upgrade to FFmpeg version 2.8.6Upgrade to FFmpeg version 2.7.6Upgrade to FFmpeg version 2.5.11Upgrade to FFmpeg version 2.4.13Upgrade to FFmpeg version 2.6.8 | Sep 29, 2017 | Feb 12, 2016 |
| Gentoo Linux | — | Upgrade media-video/ffmpeg. | Oct 30, 2017 | Feb 12, 2016 |
| Suse | — | Upgrade libswscale3Upgrade libavcodec56-debuginfo-32bitUpgrade libswresample1-32bitUpgrade libavresample2-debuginfo-32bitUpgrade libswscale-develUpgrade libavcodec56-debuginfoUpgrade ffmpeg-debugsourceUpgrade libavfilter5-debuginfo-32bitUpgrade libavfilter5-debuginfoUpgrade ffmpegUpgrade libavdevice56Upgrade libswresample1-debuginfoUpgrade libavutil54Upgrade libavutil54-debuginfoUpgrade libavdevice56-32bitUpgrade libpostproc53-32bitUpgrade libavresample-develUpgrade libavfilter5-32bitUpgrade libswscale3-debuginfoUpgrade libpostproc53Upgrade libavformat-develUpgrade libavdevice56-debuginfoUpgrade libavresample2-debuginfoUpgrade libswscale3-debuginfo-32bitUpgrade libavfilter-develUpgrade libavformat56-32bitUpgrade libavdevice-develUpgrade libpostproc53-debuginfoUpgrade libavformat56Upgrade ffmpeg-develUpgrade libavcodec56Upgrade libavresample2-32bitUpgrade libswresample1-debuginfo-32bitUpgrade libavformat56-debuginfoUpgrade libswscale3-32bitUpgrade libavcodec56-32bitUpgrade libswresample1Upgrade ffmpeg-debuginfoUpgrade libpostproc-develUpgrade libavresample2Upgrade libavutil-develUpgrade libavdevice56-debuginfo-32bitUpgrade libavutil54-debuginfo-32bitUpgrade libavutil54-32bitUpgrade libpostproc53-debuginfo-32bitUpgrade libswresample-develUpgrade libavfilter5Upgrade libavcodec-develUpgrade libavformat56-debuginfo-32bit | Feb 21, 2016 | Feb 12, 2016 |
| Ubuntu | — | Upgrade ffmpeg | Nov 19, 2024 | Feb 12, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub