The ljpeg_decode_yuv_scan function in libavcodec/mjpegdec.c in FFmpeg before 2.8.2 omits certain width and height checks, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted MJPEG data.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade ffmpeg | Feb 20, 2019 | Nov 16, 2015 |
| Ffmpeg | — | Upgrade to FFmpeg version 2.5.9Upgrade to FFmpeg version 2.8.2Upgrade to FFmpeg version 2.7.3Upgrade to FFmpeg version 2.6.5Upgrade to FFmpeg version 2.4.12 | Sep 29, 2017 | Nov 17, 2015 |
| Freebsd | — | Upgrade ffmpeg26Upgrade ffmpeg2Upgrade mythtv-frontendUpgrade libavUpgrade ffmpeg0Upgrade ffmpegUpgrade mythtvUpgrade ffmpeg23Upgrade avidemuxUpgrade ffmpeg25Upgrade ffmpeg1Upgrade avidemux26Upgrade mencoderUpgrade ffmpeg24Upgrade ffmpeg-develUpgrade avidemux2Upgrade gstreamer-ffmpegUpgrade kodiUpgrade ffmpeg-011Upgrade plexhometheaterUpgrade mplayerUpgrade handbrake | Dec 10, 2025 | Dec 2, 2015 |
| Suse | — | Upgrade ffmpegUpgrade libpostproc54Upgrade libavutil55Upgrade libavcodec57Upgrade libswresample-develUpgrade libavfilter6Upgrade libavcodec-develUpgrade libswscale4Upgrade libpostproc-develUpgrade libavformat-develUpgrade libavresample-develUpgrade libavdevice57Upgrade libswresample2Upgrade libavutil-develUpgrade libavresample3Upgrade libswscale-develUpgrade libavformat57 | Dec 18, 2015 | Nov 16, 2015 |
| Ubuntu | — | Upgrade ffmpeg | Nov 19, 2024 | Nov 17, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub