The jpeg2000_read_main_headers function in libavcodec/jpeg2000dec.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 does not enforce uniqueness of the SIZ marker in a JPEG 2000 image, which allows remote attackers to cause a denial of service (out-of-bounds heap-memory access) or possibly have unspecified other impact via a crafted image with two or more of these markers.
CVSS Details
- CVSS 3.1 Base Score: 7.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade ffmpeg | Feb 20, 2019 | Nov 26, 2015 |
| Ffmpeg | — | Upgrade to FFmpeg version 2.6.5Upgrade to FFmpeg version 2.4.12Upgrade to FFmpeg version 2.8.3Upgrade to FFmpeg version 2.7.3Upgrade to FFmpeg version 2.5.9 | Sep 29, 2017 | Nov 26, 2015 |
| Freebsd | — | Upgrade ffmpeg2Upgrade handbrakeUpgrade ffmpeg25Upgrade ffmpeg0Upgrade mplayerUpgrade avidemux2Upgrade libavUpgrade ffmpeg-011Upgrade mythtvUpgrade kodiUpgrade ffmpeg24Upgrade avidemux26Upgrade avidemuxUpgrade ffmpegUpgrade plexhometheaterUpgrade ffmpeg-develUpgrade gstreamer-ffmpegUpgrade mencoderUpgrade mythtv-frontendUpgrade ffmpeg26Upgrade ffmpeg1Upgrade ffmpeg23 | Dec 10, 2025 | Dec 2, 2015 |
| Suse | — | Upgrade libavcodec57Upgrade libavformat57Upgrade libavresample3Upgrade libavfilter6Upgrade libswresample-develUpgrade libavutil-develUpgrade libpostproc-develUpgrade libavutil55Upgrade libpostproc54Upgrade libswscale4Upgrade libavresample-develUpgrade libavcodec-develUpgrade libswresample2Upgrade libavformat-develUpgrade ffmpegUpgrade libswscale-develUpgrade libavdevice57 | Jan 4, 2016 | Nov 26, 2015 |
| Ubuntu | — | Upgrade ffmpeg | Nov 19, 2024 | Nov 26, 2015 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub