CVE-2016-2213 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Ffmpeg

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer4 documents4 sources
Severity
6.5MEDIUMNVD
EPSS
0.4%
top 38.97%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
FfmpegDebian Ffmpeg
Timeline
PublishedFeb 3
Latest updateMay 17

Description

The jpeg2000_decode_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.8.6 allows remote attackers to cause a denial of service (out-of-bounds array read access) via crafted JPEG 2000 data.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶debiandebian/ffmpeg< ffmpeg 7:2.8.6-1 (bookworm)
▶Debianffmpeg/ffmpeg< 7:2.8.6-1+3
▶NVDffmpeg/ffmpeg2.8.5

🔴Vulnerability Details

2
GHSA
GHSA-hpgr-m9m8-mhxq: The jpeg2000_decode_tile function in libavcodec/jpeg2000dec↗2022-05-17
▶
OSV
CVE-2016-2213: The jpeg2000_decode_tile function in libavcodec/jpeg2000dec↗2016-02-03
▶

📋Vendor Advisories

1
Debian
CVE-2016-2213: ffmpeg - The jpeg2000_decode_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2...↗2016
▶