The ff_rv34_decode_init_thread_copy function in libavcodec/rv34.c in FFmpeg before 2.7.2 does not initialize certain structure members, which allows remote attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via crafted (1) RV30 or (2) RV40 RealVideo data.
CVSS Details
- CVSS 3.1 Base Score: 6.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade ffmpeg | Feb 20, 2019 | Sep 5, 2015 |
| Ffmpeg | — | Upgrade to FFmpeg version 2.6.4Upgrade to FFmpeg version 2.8Upgrade to FFmpeg version 2.5.8Upgrade to FFmpeg version 2.7.2Upgrade to FFmpeg version 2.4.11 | Sep 29, 2017 | Sep 6, 2015 |
| Freebsd | — | Upgrade avidemux2Upgrade mencoderUpgrade gstreamer1-libavUpgrade handbrakeUpgrade ffmpeg24Upgrade ffmpeg25Upgrade mplayerUpgrade mythtv-frontendUpgrade mythtvUpgrade ffmpeg2Upgrade plexhometheaterUpgrade libavUpgrade avidemuxUpgrade ffmpegUpgrade ffmpeg23Upgrade gstreamer-ffmpegUpgrade ffmpeg-011Upgrade ffmpeg-develUpgrade ffmpeg26Upgrade avidemux26Upgrade ffmpeg0Upgrade kodiUpgrade ffmpeg1 | Dec 10, 2025 | Sep 20, 2015 |
| Ubuntu | — | Upgrade libavcodec53Upgrade libavformat53 | Apr 4, 2016 | Sep 5, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub