PT-2014-4481 · FFmpeg · Ffmpeg

Published 2014-03-02 · Updated 2016-12-03 · CVE-2014-2097

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 2.1.4

Description The issue is related to the tak decode frame function in libavcodec/takdec.c, which does not properly validate a certain bits-per-sample value. This allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted TAK (aka Tom's lossless Audio Kompressor) data.

Recommendations For versions prior to 2.1.4, update to version 2.1.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of the tak decode frame function until a patch is available. Avoid using crafted TAK data in the affected libavcodec/takdec.c module to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2014-2097

MGASA-2014-0280

MGASA-2014-0281

Affected Products

Ffmpeg

References · 14

• https://security.gentoo.org/glsa/201603-06 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0280 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0280.html · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-2097 · Security Note
• https://advisories.mageia.org/MGASA-2014-0281.html · Security Note
• https://osv.dev/vulnerability/MGASA-2014-0281 · Vendor Advisory
• http://ffmpeg.org/security.html · Note
• http://git.videolan.org/?p=ffmpeg.git;a=log;h=n2.0.5 · Note
• http://git.videolan.org/?p=ffmpeg.git;a=log;h=n1.1.12 · Note
• http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=f58eab151214d2d35ff0973f2b3e51c5eb372da4 · Note
• http://openwall.com/lists/oss-security/2014/06/26/23 · Note
• http://ffmpeg.org/olddownload.html · Note
• https://bugs.mageia.org/show_bug.cgi?id=13595 · Note
• https://bugs.mageia.org/show_bug.cgi?id=13594 · Note