PT-2022-7777 · FFmpeg · Ffmpeg

Gynvael Coldwind + 1 · Published 2022-06-18 · Updated 2022-06-27 · CVE-2014-125017

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FFmpeg version 2.0

Description A critical vulnerability was found in FFmpeg, affecting the rpza decode stream function. This issue leads to memory corruption and can be initiated remotely. The patch, named Fixes Invalid Writes, is intended to resolve this problem.

Recommendations Apply the Fixes Invalid Writes patch to fix this issue. As a temporary workaround, consider disabling the rpza decode stream function until the patch is applied.

Fix

Out of bounds Read

Buffer Overflow

Weakness Enumeration

CWE-125

CWE-119

Related Identifiers

CVE-2014-125017

Affected Products

Ffmpeg

References · 8

• https://ubuntu.com/security/CVE-2014-125017 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-125017 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-125017 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-125017 · Security Note
• https://t.me/cvenotify/31838 · Telegram Post
• https://vuldb.com/?id.12340 · Note
• http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=77bb0004bbe18f1498cfecdc68db5f10808b6599 · Note
• http://git.videolan.org/?p=ffmpeg.git;a=commit;h=77bb0004bbe18f1498cfecdc68db5f10808b6599 · Note