ffmpeg -- out-of-bounds array access

2015-04-1200:00:00

vuxml.freebsd.org

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

0.008

Percentile

82.2%

JSON

NVD reports:

The msrle_decode_pal4 function in msrledec.c in Libav
before 10.7 and 11.x before 11.4 and FFmpeg before 2.0.7,
2.2.x before 2.2.15, 2.4.x before 2.4.8, 2.5.x before 2.5.6,
and 2.6.x before 2.6.2 allows remote attackers to have
unspecified impact via a crafted image, related to a pixel
pointer, which triggers an out-of-bounds array access.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchlibav= 11.0UNKNOWN
FreeBSDanynoarchlibav< 11.4UNKNOWN
FreeBSDanynoarchgstreamer1-libav< 1.5.1UNKNOWN
FreeBSDanynoarchhandbrake< 1.2.0UNKNOWN
FreeBSDanynoarchffmpeg= 2.2.0,1UNKNOWN
FreeBSDanynoarchffmpeg< 2.2.15,1UNKNOWN
FreeBSDanynoarchffmpeg26< 2.6.2UNKNOWN
FreeBSDanynoarchffmpeg25< 2.5.6UNKNOWN
FreeBSDanynoarchffmpeg24< 2.4.8UNKNOWN
FreeBSDanynoarchffmpeg23= 0UNKNOWN

OS	Version	Architecture	Package	Version	Filename
FreeBSD	any	noarch	libav	= 11.0	UNKNOWN
FreeBSD	any	noarch	libav	< 11.4	UNKNOWN
FreeBSD	any	noarch	gstreamer1-libav	< 1.5.1	UNKNOWN
FreeBSD	any	noarch	handbrake	< 1.2.0	UNKNOWN
FreeBSD	any	noarch	ffmpeg	= 2.2.0,1	UNKNOWN
FreeBSD	any	noarch	ffmpeg	< 2.2.15,1	UNKNOWN
FreeBSD	any	noarch	ffmpeg26	< 2.6.2	UNKNOWN
FreeBSD	any	noarch	ffmpeg25	< 2.5.6	UNKNOWN
FreeBSD	any	noarch	ffmpeg24	< 2.4.8	UNKNOWN
FreeBSD	any	noarch	ffmpeg23	= 0	UNKNOWN