The decode_uncompressed function in libavcodec/faxcompr.c in FFmpeg before 2.8.2 does not validate uncompressed runs, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted CCITT FAX data.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade ffmpeg | Jul 30, 2024 | Nov 17, 2015 |
| Ffmpeg | — | Upgrade to FFmpeg version 2.8.2 | Sep 29, 2017 | Nov 17, 2015 |
| Freebsd | — | Upgrade ffmpeg26Upgrade kodiUpgrade ffmpegUpgrade mencoderUpgrade avidemux26Upgrade gstreamer-ffmpegUpgrade mythtv-frontendUpgrade ffmpeg-develUpgrade ffmpeg24Upgrade ffmpeg23Upgrade mythtvUpgrade plexhometheaterUpgrade mplayerUpgrade ffmpeg25Upgrade ffmpeg0Upgrade avidemuxUpgrade ffmpeg2Upgrade ffmpeg-011Upgrade handbrakeUpgrade ffmpeg1Upgrade libavUpgrade avidemux2 | Dec 10, 2025 | Dec 2, 2015 |
| Suse | — | Upgrade libswscale4Upgrade libswresample-develUpgrade libpostproc54Upgrade libavutil-develUpgrade libavfilter6Upgrade libavformat-develUpgrade libavutil55Upgrade libswscale-develUpgrade libavdevice57Upgrade libavresample-develUpgrade ffmpegUpgrade libavresample3Upgrade libswresample2Upgrade libavcodec-develUpgrade libavformat57Upgrade libpostproc-develUpgrade libavcodec57 | Dec 18, 2015 | Nov 16, 2015 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub