PT-2014-6384 · FFmpeg · Ffmpeg

Published 2014-11-03 · Updated 2016-12-03 · CVE-2014-5272

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions FFMpeg versions prior to 1.1.14 FFMpeg versions 1.2.x prior to 1.2.8 FFMpeg versions 2.2.x prior to 2.2.7 FFMpeg versions 2.3.x prior to 2.3.2

Description The issue allows remote attackers to have an unspecified impact via a crafted iff image. This is related to the rgb8 and rgbn formats and triggers an out-of-bounds array access.

Recommendations For versions prior to 1.1.14, update to version 1.1.14 or later. For versions 1.2.x prior to 1.2.8, update to version 1.2.8 or later. For versions 2.2.x prior to 2.2.7, update to version 2.2.7 or later. For versions 2.3.x prior to 2.3.2, update to version 2.3.2 or later.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2014-5272

MGASA-2014-0464

MGASA-2014-0473

MGASA-2014-0491

Affected Products

Ffmpeg

References · 22

• https://osv.dev/vulnerability/MGASA-2014-0491 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0473.html · Security Note
• https://osv.dev/vulnerability/MGASA-2014-0464 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0464.html · Security Note
• https://osv.dev/vulnerability/CVE-2014-5272 · Vendor Advisory
• https://security.gentoo.org/glsa/201603-06 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-5272 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-5272 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2014-5272 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0473 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0491.html · Security Note
• http://openwall.com/lists/oss-security/2014/08/16/6 · Note
• http://ffmpeg.org/olddownload.html · Note
• http://git.videolan.org/?p=ffmpeg.git;a=log;h=n2.0.6 · Note
• http://ffmpeg.org/security.html · Note