libavcodec/tiff.c in FFmpeg before 2.8.6 does not properly validate RowsPerStrip values and YCbCr chrominance subsampling factors, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted TIFF file, related to the tiff_decode_tag and decode_frame functions.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ffmpeg | Oct 1, 2024 | Feb 12, 2016 |
| Debian | — | Upgrade ffmpeg | Jul 30, 2024 | Feb 12, 2016 |
| Ffmpeg | — | Upgrade to FFmpeg version 2.5.11Upgrade to FFmpeg version 2.7.6Upgrade to FFmpeg version 2.8.6Upgrade to FFmpeg version 2.6.8Upgrade to FFmpeg version 2.4.13 | Sep 29, 2017 | Feb 12, 2016 |
| Gentoo Linux | — | Upgrade media-video/ffmpeg. | Oct 30, 2017 | Feb 12, 2016 |
| Suse | — | Upgrade libswresample1-32bitUpgrade libavformat-develUpgrade libswscale3Upgrade ffmpeg-debugsourceUpgrade libpostproc53-32bitUpgrade libswscale-develUpgrade libavutil54-debuginfoUpgrade ffmpegUpgrade libavresample-develUpgrade libavdevice56-debuginfoUpgrade libavcodec56-debuginfo-32bitUpgrade libavfilter5-debuginfo-32bitUpgrade libavdevice56-32bitUpgrade libavdevice56Upgrade libavresample2-debuginfoUpgrade libavfilter5-32bitUpgrade libswresample1-debuginfoUpgrade libavcodec56-debuginfoUpgrade libavutil54Upgrade libswscale3-debuginfoUpgrade libavfilter5-debuginfoUpgrade libpostproc53Upgrade libavresample2-debuginfo-32bitUpgrade libavformat56-debuginfo-32bitUpgrade libavcodec56-32bitUpgrade libpostproc53-debuginfoUpgrade libavformat56Upgrade libavutil54-debuginfo-32bitUpgrade libpostproc53-debuginfo-32bitUpgrade libswresample1-debuginfo-32bitUpgrade ffmpeg-develUpgrade libavcodec56Upgrade libavresample2-32bitUpgrade libavresample2Upgrade libavfilter5Upgrade libpostproc-develUpgrade libavutil-develUpgrade libavcodec-develUpgrade libswscale3-32bitUpgrade libswscale3-debuginfo-32bitUpgrade libavutil54-32bitUpgrade libswresample-develUpgrade libavdevice-develUpgrade libavfilter-develUpgrade libavformat56-32bitUpgrade libavdevice56-debuginfo-32bitUpgrade ffmpeg-debuginfoUpgrade libavformat56-debuginfoUpgrade libswresample1 | Feb 21, 2016 | Feb 12, 2016 |
| Ubuntu | — | Upgrade ffmpeg | Nov 19, 2024 | Feb 12, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub