The sws_init_context function in libswscale/utils.c in FFmpeg before 2.7.2 does not initialize certain pixbuf data structures, which allows remote attackers to cause a denial of service (segmentation violation) or possibly have unspecified other impact via crafted video data.
CVSS Details
- CVSS 3.1 Base Score: 8.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade ffmpeg | Feb 20, 2019 | Sep 5, 2015 |
| Ffmpeg | — | Upgrade to FFmpeg version 2.6.4Upgrade to FFmpeg version 2.7.2Upgrade to FFmpeg version 2.8Upgrade to FFmpeg version 2.4.11Upgrade to FFmpeg version 2.5.8 | Sep 29, 2017 | Sep 6, 2015 |
| Freebsd | — | Upgrade ffmpeg26Upgrade ffmpeg23Upgrade libavUpgrade ffmpeg0Upgrade ffmpegUpgrade mythtvUpgrade mythtv-frontendUpgrade ffmpeg2Upgrade mencoderUpgrade avidemux2Upgrade ffmpeg1Upgrade mplayerUpgrade ffmpeg-develUpgrade gstreamer-ffmpegUpgrade kodiUpgrade handbrakeUpgrade plexhometheaterUpgrade ffmpeg24Upgrade avidemuxUpgrade ffmpeg-011Upgrade avidemux26Upgrade gstreamer1-libavUpgrade ffmpeg25 | Dec 10, 2025 | Sep 20, 2015 |
| Ubuntu | — | Upgrade libavformat53Upgrade libavcodec53 | Apr 4, 2016 | Sep 5, 2015 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub