The ff_dwt_decode function in libavcodec/jpeg2000dwt.c in FFmpeg before 2.8.4 does not validate the number of decomposition levels before proceeding with Discrete Wavelet Transform decoding, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG 2000 data.
CVSS Details
- CVSS 3.1 Base Score: 7.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade ffmpeg | Feb 20, 2019 | Dec 23, 2015 |
| Ffmpeg | — | Upgrade to FFmpeg version 2.5.9Upgrade to FFmpeg version 2.8.4Upgrade to FFmpeg version 2.6.6Upgrade to FFmpeg version 2.4.12Upgrade to FFmpeg version 2.7.4 | Sep 29, 2017 | Dec 24, 2015 |
| Freebsd | — | Upgrade avidemuxUpgrade avidemux26Upgrade handbrakeUpgrade libavUpgrade mplayerUpgrade ffmpeg24Upgrade ffmpeg2Upgrade mythtvUpgrade ffmpeg25Upgrade gstreamer-ffmpegUpgrade mythtv-frontendUpgrade avidemux2Upgrade ffmpeg0Upgrade ffmpeg-develUpgrade ffmpegUpgrade kodiUpgrade ffmpeg-011Upgrade ffmpeg1Upgrade ffmpeg23Upgrade plexhometheaterUpgrade mencoderUpgrade ffmpeg26 | Dec 10, 2025 | Dec 28, 2015 |
| Suse | — | Upgrade libswresample2Upgrade libavutil-develUpgrade libavresample3Upgrade libavcodec-develUpgrade libavformat-develUpgrade libavresample-develUpgrade libswscale4Upgrade libavformat57Upgrade libavutil55Upgrade libswresample-develUpgrade ffmpegUpgrade libavdevice57Upgrade libavcodec57Upgrade libavfilter6Upgrade libpostproc-develUpgrade libpostproc54Upgrade libswscale-devel | Feb 2, 2016 | Dec 23, 2015 |
| Ubuntu | — | Upgrade ffmpeg | Nov 19, 2024 | Dec 24, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub