libavcodec/tiff.c in FFmpeg before 2.8.6 does not properly validate RowsPerStrip values and YCbCr chrominance subsampling factors, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted TIFF file, related to the tiff_decode_tag and decode_frame functions.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpeg | Oct 1, 2024 | Feb 12, 2016 |
| Debian | — | Upgrade ffmpeg | Jul 30, 2024 | Feb 12, 2016 |
| Ffmpeg | — | Upgrade to FFmpeg version 2.6.8Upgrade to FFmpeg version 2.4.13Upgrade to FFmpeg version 2.5.11Upgrade to FFmpeg version 2.8.6Upgrade to FFmpeg version 2.7.6 | Sep 29, 2017 | Feb 12, 2016 |
| Gentoo Linux | — | Upgrade media-video/ffmpeg. | Oct 30, 2017 | Feb 12, 2016 |
| Suse | — | Upgrade libswscale-develUpgrade libavcodec56-debuginfo-32bitUpgrade libavformat-develUpgrade libavcodec56-debuginfoUpgrade libavresample2-debuginfo-32bitUpgrade libswresample1-debuginfoUpgrade libavresample-develUpgrade libpostproc53-32bitUpgrade libavutil54-debuginfoUpgrade libswscale3Upgrade libswscale3-debuginfoUpgrade libpostproc53Upgrade ffmpegUpgrade libavfilter5-32bitUpgrade libavfilter5-debuginfo-32bitUpgrade libavdevice56-32bitUpgrade libavfilter5-debuginfoUpgrade libavutil54Upgrade ffmpeg-debugsourceUpgrade libavdevice56Upgrade libavresample2-debuginfoUpgrade libavdevice56-debuginfoUpgrade libswresample1-32bitUpgrade libswresample1Upgrade ffmpeg-debuginfoUpgrade libpostproc53-debuginfoUpgrade libavresample2Upgrade libavdevice56-debuginfo-32bitUpgrade libavutil54-debuginfo-32bitUpgrade libavresample2-32bitUpgrade libavcodec56Upgrade ffmpeg-develUpgrade libavutil-develUpgrade libavutil54-32bitUpgrade libpostproc53-debuginfo-32bitUpgrade libswresample-develUpgrade libswresample1-debuginfo-32bitUpgrade libswscale3-32bitUpgrade libpostproc-develUpgrade libavformat56Upgrade libavcodec56-32bitUpgrade libavdevice-develUpgrade libavformat56-32bitUpgrade libavfilter-develUpgrade libswscale3-debuginfo-32bitUpgrade libavformat56-debuginfoUpgrade libavformat56-debuginfo-32bitUpgrade libavcodec-develUpgrade libavfilter5 | Feb 21, 2016 | Feb 12, 2016 |
| Ubuntu | — | Upgrade ffmpeg | Nov 19, 2024 | Feb 12, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub