The jpeg2000_read_main_headers function in libavcodec/jpeg2000dec.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 does not enforce uniqueness of the SIZ marker in a JPEG 2000 image, which allows remote attackers to cause a denial of service (out-of-bounds heap-memory access) or possibly have unspecified other impact via a crafted image with two or more of these markers.
CVSS Details
- CVSS 3.1 Base Score: 7.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade ffmpeg | Feb 20, 2019 | Nov 26, 2015 |
| Ffmpeg | — | Upgrade to FFmpeg version 2.8.3Upgrade to FFmpeg version 2.5.9Upgrade to FFmpeg version 2.4.12Upgrade to FFmpeg version 2.7.3Upgrade to FFmpeg version 2.6.5 | Sep 29, 2017 | Nov 26, 2015 |
| Freebsd | — | Upgrade handbrakeUpgrade ffmpeg25Upgrade ffmpeg-011Upgrade ffmpeg2Upgrade mplayerUpgrade avidemux2Upgrade libavUpgrade ffmpeg0Upgrade ffmpegUpgrade mythtv-frontendUpgrade gstreamer-ffmpegUpgrade ffmpeg1Upgrade ffmpeg26Upgrade mencoderUpgrade avidemux26Upgrade kodiUpgrade plexhometheaterUpgrade ffmpeg-develUpgrade ffmpeg24Upgrade ffmpeg23Upgrade avidemuxUpgrade mythtv | Dec 10, 2025 | Dec 2, 2015 |
| Suse | — | Upgrade libavformat57Upgrade libpostproc-develUpgrade libavresample3Upgrade libavcodec57Upgrade libavutil55Upgrade libavfilter6Upgrade libavutil-develUpgrade libswresample-develUpgrade libavformat-develUpgrade ffmpegUpgrade libavcodec-develUpgrade libavresample-develUpgrade libswresample2Upgrade libswscale-develUpgrade libswscale4Upgrade libavdevice57Upgrade libpostproc54 | Jan 4, 2016 | Nov 26, 2015 |
| Ubuntu | — | Upgrade ffmpeg | Nov 19, 2024 | Nov 26, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub