The ljpeg_decode_yuv_scan function in libavcodec/mjpegdec.c in FFmpeg before 2.8.2 omits certain width and height checks, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted MJPEG data.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade ffmpeg | Feb 20, 2019 | Nov 16, 2015 |
| Ffmpeg | — | Upgrade to FFmpeg version 2.7.3Upgrade to FFmpeg version 2.5.9Upgrade to FFmpeg version 2.8.2Upgrade to FFmpeg version 2.6.5Upgrade to FFmpeg version 2.4.12 | Sep 29, 2017 | Nov 17, 2015 |
| Freebsd | — | Upgrade libavUpgrade avidemuxUpgrade ffmpeg23Upgrade ffmpeg2Upgrade mythtv-frontendUpgrade ffmpeg0Upgrade mythtvUpgrade ffmpegUpgrade ffmpeg26Upgrade ffmpeg-011Upgrade mencoderUpgrade ffmpeg1Upgrade gstreamer-ffmpegUpgrade ffmpeg-develUpgrade avidemux26Upgrade avidemux2Upgrade ffmpeg24Upgrade mplayerUpgrade kodiUpgrade handbrakeUpgrade ffmpeg25Upgrade plexhometheater | Dec 10, 2025 | Dec 2, 2015 |
| Suse | — | Upgrade libswresample-develUpgrade libavfilter6Upgrade libavresample-develUpgrade libswscale-develUpgrade libavdevice57Upgrade libavcodec-develUpgrade libswresample2Upgrade libpostproc-develUpgrade libavformat57Upgrade libavresample3Upgrade libswscale4Upgrade libavformat-develUpgrade libavutil-develUpgrade ffmpegUpgrade libavcodec57Upgrade libpostproc54Upgrade libavutil55 | Dec 18, 2015 | Nov 16, 2015 |
| Ubuntu | — | Upgrade ffmpeg | Nov 19, 2024 | Nov 17, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub