Debian Ffmpeg vulnerabilities

CVE-2013-0844 [CRITICAL] CVE-2013-0844: ffmpeg - Off-by-one error in the adpcm_decode_frame function in libavcodec/adpcm.c in FFm... Off-by-one error in the adpcm_decode_frame function in libavcodec/adpcm.c in FFmpeg before 1.0.4 allows remote attackers to have an unspecified impact via crafted DK4 data, which triggers an out-of-bounds array access. Scope: local bookworm: resolved (fixed in 7:2.4.1-1) bullseye: resolved (fixed in 7:2.4.1-1) forky: resolved (fixed in 7:2.4.1-1) sid: resolved (fix

CVE-2013-0865 [CRITICAL] CVE-2013-0865: ffmpeg - The vqa_decode_chunk function in libavcodec/vqavideo.c in FFmpeg before 1.0.4 an... The vqa_decode_chunk function in libavcodec/vqavideo.c in FFmpeg before 1.0.4 and 1.1.x before 1.1.2 allows remote attackers to have an unspecified impact via a large (1) cbp0 or (2) cbpz chunk in Westwood Studios VQA Video file, which triggers an out-of-bounds write. Scope: local bookworm: resolved (fixed in 7:2.4.1-1) bullseye: resolved (fixed in 7:2.4.1-1) forky

CVE-2017-9992 [HIGH] CVE-2017-9992: ffmpeg - Heap-based buffer overflow in the decode_dds1 function in libavcodec/dfa.c in FF... Heap-based buffer overflow in the decode_dds1 function in libavcodec/dfa.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file. Scope: local bookworm: resolved (fixed in 7:3.2.5-1)

CVE-2019-11339 [HIGH] CVE-2019-11339: ffmpeg - The studio profile decoder in libavcodec/mpeg4videodec.c in FFmpeg 4.0 before 4.... The studio profile decoder in libavcodec/mpeg4videodec.c in FFmpeg 4.0 before 4.0.4 and 4.1 before 4.1.2 allows remote attackers to cause a denial of service (out-of-array access) or possibly have unspecified other impact via crafted MPEG-4 video data. Scope: local bookworm: resolved (fixed in 7:4.1.3-1) bullseye: resolved (fixed in 7:4.1.3-1) forky: resolved (fixed

CVE-2017-14767 [HIGH] CVE-2017-14767: ffmpeg - The sdp_parse_fmtp_config_h264 function in libavformat/rtpdec_h264.c in FFmpeg b... The sdp_parse_fmtp_config_h264 function in libavformat/rtpdec_h264.c in FFmpeg before 3.3.4 mishandles empty sprop-parameter-sets values, which allows remote attackers to cause a denial of service (heap buffer overflow) or possibly have unspecified other impact via a crafted sdp file. Scope: local bookworm: resolved (fixed in 7:3.3.4-1) bullseye: resolved (fixed in 7

CVE-2017-14169 [HIGH] CVE-2017-14169: ffmpeg - In the mxf_read_primer_pack function in libavformat/mxfdec.c in FFmpeg 3.3.3 -> ... In the mxf_read_primer_pack function in libavformat/mxfdec.c in FFmpeg 3.3.3 -> 2.4, an integer signedness error might occur when a crafted file, which claims a large "item_num" field such as 0xffffffff, is provided. As a result, the variable "item_num" turns negative, bypassing the check for a large value. Scope: local bookworm: resolved (fixed in 7:3.3.4-1) bullsey

CVE-2017-14225 [HIGH] CVE-2017-14225: ffmpeg - The av_color_primaries_name function in libavutil/pixdesc.c in FFmpeg 3.3.3 may ... The av_color_primaries_name function in libavutil/pixdesc.c in FFmpeg 3.3.3 may return a NULL pointer depending on a value contained in a file, but callers do not anticipate this, as demonstrated by the avcodec_string function in libavcodec/utils.c, leading to a NULL pointer dereference. (It is also conceivable that there is security relevance for a NULL pointer dere

CVE-2023-6605 [HIGH] CVE-2023-6605: ffmpeg - A flaw was found in FFmpeg's DASH playlist support. This vulnerability allows ar... A flaw was found in FFmpeg's DASH playlist support. This vulnerability allows arbitrary HTTP GET requests to be made on behalf of the machine running FFmpeg via a crafted DASH playlist containing malicious URLs. Scope: local bookworm: resolved (fixed in 7:5.1.7-0+deb12u1) bullseye: resolved (fixed in 7:4.3.9-0+deb11u1) forky: resolved (fixed in 7:7.1.1-1) sid: resolved

CVE-2005-4048 [HIGH] CVE-2005-4048: ffmpeg - Heap-based buffer overflow in the avcodec_default_get_buffer function (utils.c) ... Heap-based buffer overflow in the avcodec_default_get_buffer function (utils.c) in FFmpeg libavcodec 0.4.9-pre1 and earlier, as used in products such as (1) mplayer, (2) xine-lib, (3) Xmovie, and (4) GStreamer, allows remote attackers to execute arbitrary commands via small PNG images with palettes. Scope: local bookworm: resolved (fixed in 0.cvs20050918-5.1) bullseye:

CVE-2016-5199 [HIGH] CVE-2016-5199: ffmpeg - An off by one error resulting in an allocation of zero size in FFmpeg in Google ... An off by one error resulting in an allocation of zero size in FFmpeg in Google Chrome prior to 54.0.2840.98 for Mac, and 54.0.2840.99 for Windows, and 54.0.2840.100 for Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted video file. Scope: local bookworm: resolved (fixed in 7:3.2-1) bullseye: resolved (fix

CVE-2022-2566 [CRITICAL] CVE-2022-2566: ffmpeg - A heap out-of-bounds memory write exists in FFMPEG since version 5.1. The size c... A heap out-of-bounds memory write exists in FFMPEG since version 5.1. The size calculation in `build_open_gop_key_points()` goes through all entries in the loop and adds `sc->ctts_data[i].count` to `sc->sample_offsets_count`. This can lead to an integer overflow resulting in a small allocation with `av_calloc()`. An attacker can cause remote code execution via a ma

CVE-2015-8661 [HIGH] CVE-2015-8661: ffmpeg - The h264_slice_header_init function in libavcodec/h264_slice.c in FFmpeg before ... The h264_slice_header_init function in libavcodec/h264_slice.c in FFmpeg before 2.8.3 does not validate the relationship between the number of threads and the number of slices, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted H.264 data. Scope: local bookworm: resolved (fixed i

CVE-2015-8663 [HIGH] CVE-2015-8663: ffmpeg - The ff_get_buffer function in libavcodec/utils.c in FFmpeg before 2.8.4 preserve... The ff_get_buffer function in libavcodec/utils.c in FFmpeg before 2.8.4 preserves width and height values after a failure, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted .mov file. Scope: local bookworm: resolved (fixed in 7:2.8.4-1) bullseye: resolved (fixed in 7:2.8.4-1)

CVE-2012-2777 [CRITICAL] CVE-2012-2777: ffmpeg - Unspecified vulnerability in the decode_pic function in libavcodec/cavsdec.c in ... Unspecified vulnerability in the decode_pic function in libavcodec/cavsdec.c in FFmpeg before 0.11, and Libav 0.7.x before 0.7.7 and 0.8.x before 0.8.4, has unknown impact and attack vectors, related to "width/height changing in CAVS," a different vulnerability than CVE-2012-2784. Scope: local bookworm: resolved (fixed in 7:2.4.1-1) bullseye: resolved (fixed in 7:2

CVE-2012-5361 [HIGH] CVE-2012-5361: ffmpeg - Libavcodec in FFmpeg before 0.11 allows remote attackers to execute arbitrary co... Libavcodec in FFmpeg before 0.11 allows remote attackers to execute arbitrary code via a crafted WMV file. Scope: local bookworm: resolved (fixed in 7:2.4.1-1) bullseye: resolved (fixed in 7:2.4.1-1) forky: resolved (fixed in 7:2.4.1-1) sid: resolved (fixed in 7:2.4.1-1) trixie: resolved (fixed in 7:2.4.1-1)

CVE-2012-2804 [CRITICAL] CVE-2012-2804: ffmpeg - Unspecified vulnerability in libavcodec/indeo3.c in FFmpeg before 0.11 and Libav... Unspecified vulnerability in libavcodec/indeo3.c in FFmpeg before 0.11 and Libav 0.8.x before 0.8.5 has unknown impact and attack vectors, related to "reallocation code" and the luma height and width. Scope: local bookworm: resolved (fixed in 7:2.4.1-1) bullseye: resolved (fixed in 7:2.4.1-1) forky: resolved (fixed in 7:2.4.1-1) sid: resolved (fixed in 7:2.4.1-1) t

CVE-2025-59732 [HIGH] CVE-2025-59732: ffmpeg - When decoding an OpenEXR file that uses DWAA or DWAB compression, there's an imp... When decoding an OpenEXR file that uses DWAA or DWAB compression, there's an implicit assumption that the height and width are divisible by 8. If the height or width of the image is not divisible by 8, the copy loops at [0] and [1] will continue to write until the next multiple of 8. The buffer td->uncompressed_data is allocated in decode_block based on the precise h

CVE-2025-59733 [HIGH] CVE-2025-59733: ffmpeg - When decoding an OpenEXR file that uses DWAA or DWAB compression, there's an imp... When decoding an OpenEXR file that uses DWAA or DWAB compression, there's an implicit assumption that all image channels have the same pixel type (and size), and that if there are four channels, the first four are "B", "G", "R" and "A". The channel parsing code can be found in decode_header. The buffer td->uncompressed_data is allocated in decode_block based on the x

CVE-2017-9051 [CRITICAL] CVE-2017-9051: ffmpeg - libav before 12.1 is vulnerable to an invalid read of size 1 due to NULL pointer... libav before 12.1 is vulnerable to an invalid read of size 1 due to NULL pointer dereferencing in the nsv_read_chunk function in libavformat/nsvdec.c. Scope: local bookworm: resolved (fixed in 7:2.6.1-1) bullseye: resolved (fixed in 7:2.6.1-1) forky: resolved (fixed in 7:2.6.1-1) sid: resolved (fixed in 7:2.6.1-1) trixie: resolved (fixed in 7:2.6.1-1)

CVE-2013-0846 [CRITICAL] CVE-2013-0846: ffmpeg - Array index error in the qdm2_decode_super_block function in libavcodec/qdm2.c i... Array index error in the qdm2_decode_super_block function in libavcodec/qdm2.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via crafted QDM2 data, which triggers an out-of-bounds array access. Scope: local bookworm: resolved (fixed in 7:2.4.1-1) bullseye: resolved (fixed in 7:2.4.1-1) forky: resolved (fixed in 7:2.4.1-1) sid: resolved