The init_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.8.2 does not enforce minimum-value and maximum-value constraints on tile coordinates, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG 2000 data.
CVSS Details
- CVSS 3.1 Base Score: 6.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade ffmpeg | Jul 30, 2024 | Nov 17, 2015 |
| Ffmpeg | — | Upgrade to FFmpeg version 2.4.12Upgrade to FFmpeg version 2.6.5Upgrade to FFmpeg version 2.8.2Upgrade to FFmpeg version 2.7.3Upgrade to FFmpeg version 2.5.9 | Sep 29, 2017 | Nov 17, 2015 |
| Freebsd | — | Upgrade handbrakeUpgrade ffmpeg0Upgrade mplayerUpgrade ffmpeg25Upgrade ffmpeg-develUpgrade ffmpeg2Upgrade gstreamer-ffmpegUpgrade avidemux26Upgrade ffmpeg24Upgrade mythtvUpgrade avidemux2Upgrade mythtv-frontendUpgrade libavUpgrade ffmpeg-011Upgrade plexhometheaterUpgrade ffmpegUpgrade ffmpeg1Upgrade kodiUpgrade ffmpeg23Upgrade ffmpeg26Upgrade mencoderUpgrade avidemux | Dec 10, 2025 | Dec 2, 2015 |
| Suse | — | Upgrade libavdevice57Upgrade libswscale-develUpgrade libswresample2Upgrade libavresample-develUpgrade libavresample3Upgrade libpostproc-develUpgrade libavcodec-develUpgrade libavcodec57Upgrade ffmpegUpgrade libavfilter6Upgrade libavformat57Upgrade libswresample-develUpgrade libavutil-develUpgrade libavformat-develUpgrade libpostproc54Upgrade libavutil55Upgrade libswscale4 | Dec 18, 2015 | Nov 16, 2015 |
| Ubuntu | — | Upgrade ffmpeg | Nov 19, 2024 | Nov 17, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub