The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The ff_mjpeg_decode_sof function in libavcodec/mjpegdec.c in FFmpeg before 2.5.4 does not validate the number of components in a JPEG-LS Start Of Frame segment, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Motion JPEG data.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade ffmpegUpgrade libav | Mar 31, 2017 | Jul 26, 2015 |
| Ffmpeg | — | Upgrade to FFmpeg version 2.2.13Upgrade to FFmpeg version 0.7.17Upgrade to FFmpeg version 2.4.7Upgrade to FFmpeg version 2.1.8Upgrade to FFmpeg version 1.2.12Upgrade to FFmpeg version 2.5.4Upgrade to FFmpeg version 2.0.7 | Sep 29, 2017 | Jul 26, 2015 |
| Freebsd | — | Upgrade avidemux2Upgrade ffmpegUpgrade avidemux26Upgrade ffmpeg0 | Dec 10, 2025 | Jun 2, 2015 |
| Ubuntu | — | Upgrade libavformat53Upgrade libavcodec53 | Apr 4, 2016 | Jul 26, 2015 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub