The sws_init_context function in libswscale/utils.c in FFmpeg before 2.7.2 does not initialize certain pixbuf data structures, which allows remote attackers to cause a denial of service (segmentation violation) or possibly have unspecified other impact via crafted video data.
CVSS Details
- CVSS 3.1 Base Score: 8.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade ffmpeg | Feb 20, 2019 | Sep 5, 2015 |
| Ffmpeg | — | Upgrade to FFmpeg version 2.6.4Upgrade to FFmpeg version 2.7.2Upgrade to FFmpeg version 2.8Upgrade to FFmpeg version 2.4.11Upgrade to FFmpeg version 2.5.8 | Sep 29, 2017 | Sep 6, 2015 |
| Freebsd | — | Upgrade ffmpeg-develUpgrade gstreamer-ffmpegUpgrade ffmpeg1Upgrade plexhometheaterUpgrade avidemux2Upgrade ffmpeg-011Upgrade ffmpeg24Upgrade avidemux26Upgrade mencoderUpgrade ffmpeg25Upgrade gstreamer1-libavUpgrade avidemuxUpgrade mplayerUpgrade kodiUpgrade handbrakeUpgrade ffmpeg0Upgrade mythtvUpgrade ffmpeg23Upgrade ffmpegUpgrade libavUpgrade ffmpeg26Upgrade ffmpeg2Upgrade mythtv-frontend | Dec 10, 2025 | Sep 20, 2015 |
| Ubuntu | — | Upgrade libavcodec53Upgrade libavformat53 | Apr 4, 2016 | Sep 5, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub