The decode_uncompressed function in libavcodec/faxcompr.c in FFmpeg before 2.8.2 does not validate uncompressed runs, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted CCITT FAX data.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade ffmpeg | Jul 30, 2024 | Nov 17, 2015 |
| Ffmpeg | — | Upgrade to FFmpeg version 2.8.2 | Sep 29, 2017 | Nov 17, 2015 |
| Freebsd | — | Upgrade ffmpeg25Upgrade mplayerUpgrade ffmpeg26Upgrade mencoderUpgrade kodiUpgrade ffmpegUpgrade ffmpeg23Upgrade gstreamer-ffmpegUpgrade mythtv-frontendUpgrade ffmpeg24Upgrade avidemux26Upgrade mythtvUpgrade plexhometheaterUpgrade ffmpeg-develUpgrade ffmpeg2Upgrade avidemuxUpgrade ffmpeg0Upgrade handbrakeUpgrade ffmpeg-011Upgrade libavUpgrade avidemux2Upgrade ffmpeg1 | Dec 10, 2025 | Dec 2, 2015 |
| Suse | — | Upgrade libswscale4Upgrade libavutil-develUpgrade libpostproc54Upgrade libavutil55Upgrade libavformat-develUpgrade libswscale-develUpgrade libswresample-develUpgrade libavfilter6Upgrade libavcodec-develUpgrade libavresample3Upgrade libpostproc-develUpgrade libavcodec57Upgrade ffmpegUpgrade libavdevice57Upgrade libavresample-develUpgrade libswresample2Upgrade libavformat57 | Dec 18, 2015 | Nov 16, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub