The ff_get_buffer function in libavcodec/utils.c in FFmpeg before 2.8.4 preserves width and height values after a failure, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted .mov file.
CVSS Details
- CVSS 3.1 Base Score: 8.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade ffmpeg | Feb 20, 2019 | Dec 23, 2015 |
| Ffmpeg | — | Upgrade to FFmpeg version 2.4.12Upgrade to FFmpeg version 2.7.4Upgrade to FFmpeg version 2.5.9Upgrade to FFmpeg version 2.6.6Upgrade to FFmpeg version 2.8.4 | Sep 29, 2017 | Dec 24, 2015 |
| Freebsd | — | Upgrade handbrakeUpgrade ffmpeg0Upgrade ffmpeg-develUpgrade avidemux26Upgrade gstreamer-ffmpegUpgrade avidemux2Upgrade mplayerUpgrade ffmpeg-011Upgrade libavUpgrade ffmpeg25Upgrade mythtvUpgrade ffmpeg23Upgrade avidemuxUpgrade ffmpeg26Upgrade mencoderUpgrade plexhometheaterUpgrade kodiUpgrade ffmpegUpgrade ffmpeg24Upgrade ffmpeg2Upgrade ffmpeg1Upgrade mythtv-frontend | Dec 10, 2025 | Dec 28, 2015 |
| Suse | — | Upgrade libavresample-develUpgrade ffmpegUpgrade libavcodec57Upgrade libavfilter6Upgrade libavformat-develUpgrade libswresample-develUpgrade libavdevice57Upgrade libpostproc-develUpgrade libswscale-develUpgrade libpostproc54Upgrade libswresample2Upgrade libavresample3Upgrade libswscale4Upgrade libavformat57Upgrade libavutil55Upgrade libavcodec-develUpgrade libavutil-devel | Feb 2, 2016 | Dec 23, 2015 |
| Ubuntu | — | Upgrade ffmpeg | Nov 19, 2024 | Dec 24, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub