The allocate_buffers function in libavcodec/alac.c in FFmpeg before 2.7.2 does not initialize certain context data, which allows remote attackers to cause a denial of service (segmentation violation) or possibly have unspecified other impact via crafted Apple Lossless Audio Codec (ALAC) data.
CVSS Details
- CVSS 3.1 Base Score: 8.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade ffmpeg | Feb 20, 2019 | Sep 5, 2015 |
| Ffmpeg | — | Upgrade to FFmpeg version 2.6.4Upgrade to FFmpeg version 2.8Upgrade to FFmpeg version 2.4.11Upgrade to FFmpeg version 2.7.2Upgrade to FFmpeg version 2.5.8 | Sep 29, 2017 | Sep 6, 2015 |
| Freebsd | — | Upgrade gstreamer-ffmpegUpgrade ffmpeg25Upgrade ffmpeg0Upgrade libavUpgrade avidemux2Upgrade handbrakeUpgrade avidemux26Upgrade mplayerUpgrade ffmpeg-011Upgrade mythtvUpgrade kodiUpgrade gstreamer1-libavUpgrade ffmpeg26Upgrade ffmpeg2Upgrade ffmpeg24Upgrade ffmpegUpgrade ffmpeg23Upgrade ffmpeg1Upgrade avidemuxUpgrade plexhometheaterUpgrade ffmpeg-develUpgrade mythtv-frontendUpgrade mencoder | Dec 10, 2025 | Sep 20, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub