Overview 525 matches · 1 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 2 public PoC · 0 EPSS ≥ 0.5
525matches
1in Waratek scope0.2%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
2public PoC0.4%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
1
0.2%
Outside Waratek scope
0
0.0%
Not applicable
524
99.8%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
525
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
2
0.4%
Proof of concept only
25
4.8%
Forecast only
0
0.0%
No public exploit
498
94.9%
split by
peak 78 / year
20051
Not applicable1
High1
not blocked1
No public exploit1
20061
Not applicable1
High1
not blocked1
No public exploit1
20070
20085
Not applicable5
High5
not blocked5
Working exploit published1
No public exploit4
20091
Not applicable1
High1
not blocked1
No public exploit1
201011
Not applicable11
High5
Medium6
not blocked11
Working exploit published1
No public exploit10
201113
Not applicable13
High4
Medium9
not blocked13
No public exploit13
201254
Not applicable54
High28
Medium25
Low1
not blocked54
No public exploit54
201378
Not applicable78
High41
Medium36
Low1
not blocked78
No public exploit78
201419
Not applicable19
High13
Medium6
not blocked19
No public exploit19
201529
Not applicable29
High20
Medium9
not blocked29
No public exploit29
201620
Not applicable20
High9
Medium11
not blocked20
No public exploit20
201747
Not applicable47
Critical16
High17
Medium14
not blocked47
No public exploit47
201830
Not applicable30
Critical1
High9
Medium20
not blocked30
No public exploit30
201911
Not applicable11
Critical3
High4
Medium4
not blocked11
No public exploit11
20204
Not applicable4
Critical1
High2
Medium1
not blocked4
No public exploit4
202166
Not applicable66
Critical2
High33
Medium31
not blocked66
No public exploit66
202230
Not applicable30
Critical2
High8
Medium20
not blocked30
No public exploit30
20237
No exploit published1
Not applicable6
Critical1
High3
Medium3
not blocked7
No public exploit7
202437
Not applicable37
Critical6
High17
Medium13
Low1
not blocked37
Proof of concept only13
No public exploit24
202519
Not applicable19
High9
Medium10
not blocked19
Proof of concept only10
No public exploit9
202642
Not applicable42
Critical1
High27
Medium14
not blocked42
Proof of concept only2
No public exploit40
20062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2020-35964 | Medium | 2021-01-03 | Not applicable | No public exploit | track_header in libavformat/vividas.c in FFmpeg 4.3.1 has an out-of-bounds write because of incorrect extradata packing. |
| CVE-2020-14212 | High | 2020-06-16 | Not applicable | No public exploit | FFmpeg through 4.3 has a heap-based buffer overflow in avio_get_str in libavformat/aviobuf.c because dnn_backend_native.c calls ff_dnn_load_model_native and a certain index check is omitted. |
| CVE-2020-13904 | Medium | 2020-06-07 | Not applicable | No public exploit | FFmpeg 2.8 and 4.2.3 has a use-after-free via a crafted EXTINF duration in an m3u8 file because parse_playlist in libavformat/hls.c frees a pointer, and later that pointer is accessed in av_probe_input_format3 in libavformat/format.c. |
| CVE-2020-12284 | Critical | 2020-04-28 | Not applicable | No public exploit | cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MARKER_SOS handling because of a missing length check. |
| CVE-2014-4610 | High | 2020-01-14 | Not applicable | No public exploit | Integer overflow in the get_len function in libavutil/lzo.c in FFmpeg before 0.10.14, 1.1.x before 1.1.12, 1.2.x before 1.2.7, 2.0.x before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.4 allows remote attackers to execute arbitrary code via a crafted Literal Run. |
| CVE-2019-17542 | Critical | 2019-10-14 | Not applicable | No public exploit | FFmpeg before 4.2 has a heap-based buffer overflow in vqa_decode_chunk because of an out-of-array access in vqa_decode_init in libavcodec/vqavideo.c. |
| CVE-2019-17539 | Critical | 2019-10-14 | Not applicable | No public exploit | In FFmpeg before 4.2, avcodec_open2 in libavcodec/utils.c allows a NULL pointer dereference and possibly unspecified other impact when there is no valid close function pointer. |
| CVE-2019-15942 | High | 2019-09-05 | Not applicable | No public exploit | FFmpeg through 4.2 has a "Conditional jump or move depends on uninitialised value" issue in h2645_parse because alloc_rbsp_buffer in libavcodec/h2645_parse.c mishandles rbsp_buffer. |
| CVE-2019-13390 | Medium | 2019-07-07 | Not applicable | No public exploit | In FFmpeg 4.1.3, there is a division by zero at adx_write_trailer in libavformat/rawenc.c. |
| CVE-2019-13312 | High | 2019-07-05 | Not applicable | No public exploit | block_cmp() in libavcodec/zmbvenc.c in FFmpeg 4.1.3 has a heap-based buffer over-read. |
| CVE-2019-12730 | Critical | 2019-06-04 | Not applicable | No public exploit | aa_read_header in libavformat/aadec.c in FFmpeg before 3.2.14 and 4.x before 4.1.4 does not check for sscanf failure and consequently allows use of uninitialized variables. |
| CVE-2019-11339 | High | 2019-04-19 | Not applicable | No public exploit | The studio profile decoder in libavcodec/mpeg4videodec.c in FFmpeg 4.0 before 4.0.4 and 4.1 before 4.1.2 allows remote attackers to cause a denial of service (out-of-array access) or possibly have unspecified other impact via crafted MPEG-4 video data. |
| CVE-2019-11338 | High | 2019-04-19 | Not applicable | No public exploit | libavcodec/hevcdec.c in FFmpeg 3.4 and 4.1.2 mishandles detection of duplicate first slices, which allows remote attackers to cause a denial of service (NULL pointer dereference and out-of-array access) or possibly have unspecified other impact via crafted HEVC data. |
| CVE-2019-9721 | Medium | 2019-03-12 | Not applicable | No public exploit | A denial of service in the subtitle decoder in FFmpeg 3.2 and 4.1 allows attackers to hog the CPU via a crafted video file in Matroska format, because handle_open_brace in libavcodec/htmlsubtitles.c has a complex format argument to sscanf. |
| CVE-2019-9718 | Medium | 2019-03-12 | Not applicable | No public exploit | In FFmpeg 3.2 and 4.1, a denial of service in the subtitle decoder allows attackers to hog the CPU via a crafted video file in Matroska format, because ff_htmlmarkup_to_ass in libavcodec/htmlsubtitles.c has a complex format argument to sscanf. |
| CVE-2019-1000016 | Medium | 2019-02-04 | Not applicable | No public exploit | FFMPEG version 4.1 contains a CWE-129: Improper Validation of Array Index vulnerability in libavcodec/cbs_av1.c that can result in Denial of service. This attack appears to be exploitable via specially crafted AV1 file has to be provided as input. This vulnerability appears to have been fixed in after commit b97a4b658814b2de8b9f2a3bce491c002d34de31. |
| CVE-2018-15822 | High | 2018-08-23 | Not applicable | No public exploit | The flv_write_packet function in libavformat/flvenc.c in FFmpeg through 2.8 does not check for an empty audio packet, leading to an assertion failure. |
| CVE-2018-1999015 | Medium | 2018-07-23 | Not applicable | No public exploit | FFmpeg before commit 5aba5b89d0b1d73164d3b81764828bb8b20ff32a contains an out of array read vulnerability in ASF_F format demuxer that can result in heap memory reading. This attack appear to be exploitable via specially crafted ASF file that has to provided as input. This vulnerability appears to have been fixed in 5aba5b89d0b1d73164d3b81764828bb8b20ff32a and later. |
| CVE-2018-1999014 | Medium | 2018-07-23 | Not applicable | No public exploit | FFmpeg before commit bab0716c7f4793ec42e05a5aa7e80d82a0dd4e75 contains an out of array access vulnerability in MXF format demuxer that can result in DoS. This attack appear to be exploitable via specially crafted MXF file which has to be provided as input. This vulnerability appears to have been fixed in bab0716c7f4793ec42e05a5aa7e80d82a0dd4e75 and later. |
| CVE-2018-1999013 | Medium | 2018-07-23 | Not applicable | No public exploit | FFmpeg before commit a7e032a277452366771951e29fd0bf2bd5c029f0 contains a use-after-free vulnerability in the realmedia demuxer that can result in vulnerability allows attacker to read heap memory. This attack appear to be exploitable via specially crafted RM file has to be provided as input. This vulnerability appears to have been fixed in a7e032a277452366771951e29fd0bf2bd5c029f0 and later. |
| CVE-2018-1999012 | Medium | 2018-07-23 | Not applicable | No public exploit | FFmpeg before commit 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 contains a CWE-835: Infinite loop vulnerability in pva format demuxer that can result in a Vulnerability that allows attackers to consume excessive amount of resources like CPU and RAM. This attack appear to be exploitable via specially crafted PVA file has to be provided as input. This vulnerability appears to have been fixed in 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 and later. |
| CVE-2018-1999011 | High | 2018-07-23 | Not applicable | No public exploit | FFmpeg before commit 2b46ebdbff1d8dec7a3d8ea280a612b91a582869 contains a Buffer Overflow vulnerability in asf_o format demuxer that can result in heap-buffer-overflow that may result in remote code execution. This attack appears to be exploitable via specially crafted ASF file that has to be provided as input to FFmpeg. This vulnerability appears to have been fixed in 2b46ebdbff1d8dec7a3d8ea280a612b91a582869 and later. |
| CVE-2018-1999010 | Critical | 2018-07-23 | Not applicable | No public exploit | FFmpeg before commit cced03dd667a5df6df8fd40d8de0bff477ee02e8 contains multiple out of array access vulnerabilities in the mms protocol that can result in attackers accessing out of bound data. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in cced03dd667a5df6df8fd40d8de0bff477ee02e8 and later. |
| CVE-2018-14395 | Medium | 2018-07-19 | Not applicable | No public exploit | libavformat/movenc.c in FFmpeg 3.2 and 4.0.2 allows attackers to cause a denial of service (application crash caused by a divide-by-zero error) with a user crafted audio file when converting to the MOV audio format. |
| CVE-2018-14394 | Medium | 2018-07-19 | Not applicable | No public exploit | libavformat/movenc.c in FFmpeg before 4.0.2 allows attackers to cause a denial of service (application crash caused by a divide-by-zero error) with a user crafted Waveform audio file. |
| CVE-2018-13305 | High | 2018-07-05 | Not applicable | No public exploit | In FFmpeg 4.0.1, due to a missing check for negative values of the mquant variable, the vc1_put_blocks_clamped function in libavcodec/vc1_block.c may trigger an out-of-array access while converting a crafted AVI file to MPEG4, leading to an information disclosure or a denial of service. |
| CVE-2018-13304 | Medium | 2018-07-05 | Not applicable | No public exploit | In libavcodec in FFmpeg 4.0.1, improper maintenance of the consistency between the context profile field and studio_profile in libavcodec may trigger an assertion failure while converting a crafted AVI file to MPEG4, leading to a denial of service, related to error_resilience.c, h263dec.c, and mpeg4videodec.c. |
| CVE-2018-13303 | Medium | 2018-07-05 | Not applicable | No public exploit | In FFmpeg 4.0.1, a missing check for failure of a call to init_get_bits8() in the avpriv_ac3_parse_header function in libavcodec/ac3_parser.c may trigger a NULL pointer dereference while converting a crafted AVI file to MPEG4, leading to a denial of service. |
| CVE-2018-13302 | High | 2018-07-05 | Not applicable | No public exploit | In FFmpeg 4.0.1, improper handling of frame types (other than EAC3_FRAME_TYPE_INDEPENDENT) that have multiple independent substreams in the handle_eac3 function in libavformat/movenc.c may trigger an out-of-array access while converting a crafted AVI file to MPEG4, leading to a denial of service or possibly unspecified other impact. |
| CVE-2018-13301 | Medium | 2018-07-05 | Not applicable | No public exploit | In FFmpeg 4.0.1, due to a missing check of a profile value before setting it, the ff_mpeg4_decode_picture_header function in libavcodec/mpeg4videodec.c may trigger a NULL pointer dereference while converting a crafted AVI file to MPEG4, leading to a denial of service. |
| CVE-2018-13300 | High | 2018-07-05 | Not applicable | No public exploit | In FFmpeg 3.2 and 4.0.1, an improper argument (AVCodecParameters) passed to the avpriv_request_sample function in the handle_eac3 function in libavformat/movenc.c may trigger an out-of-array read while converting a crafted AVI file to MPEG4, leading to a denial of service and possibly an information disclosure. |
| CVE-2018-12460 | Medium | 2018-06-15 | Not applicable | No public exploit | libavcodec in FFmpeg 4.0 may trigger a NULL pointer dereference if the studio profile is incorrectly detected while converting a crafted AVI file to MPEG4, leading to a denial of service, related to idctdsp.c and mpegvideo.c. |
| CVE-2018-12459 | Medium | 2018-06-15 | Not applicable | No public exploit | An inconsistent bits-per-sample value in the ff_mpeg4_decode_picture_header function in libavcodec/mpeg4videodec.c in FFmpeg 4.0 may trigger an assertion violation while converting a crafted AVI file to MPEG4, leading to a denial of service. |
| CVE-2018-12458 | Medium | 2018-06-15 | Not applicable | No public exploit | An improper integer type in the mpeg4_encode_gop_header function in libavcodec/mpeg4videoenc.c in FFmpeg 2.8 and 4.0 may trigger an assertion violation while converting a crafted AVI file to MPEG4, leading to a denial of service. |
| CVE-2017-16069 | High | 2018-06-07 | Not applicable | No public exploit | nodeffmpeg was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
| CVE-2018-7751 | Medium | 2018-04-24 | Not applicable | No public exploit | The svg_probe function in libavformat/img2dec.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service (Infinite Loop) via a crafted XML file. |
| CVE-2018-10001 | Medium | 2018-04-11 | Not applicable | No public exploit | The decode_init function in libavcodec/utvideodec.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service (out of array read) via an AVI file. |
| CVE-2018-9841 | High | 2018-04-07 | Not applicable | No public exploit | The export function in libavfilter/vf_signature.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service (out-of-array access) or possibly have unspecified other impact via a long filename. |
| CVE-2018-7557 | Medium | 2018-02-28 | Not applicable | No public exploit | The decode_init function in libavcodec/utvideodec.c in FFmpeg 2.8 through 3.4.2 allows remote attackers to cause a denial of service (Out of array read) via an AVI file with crafted dimensions within chroma subsampling data. |
| CVE-2018-6912 | Medium | 2018-02-12 | Not applicable | No public exploit | The decode_plane function in libavcodec/utvideodec.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service (out of array read) via a crafted AVI file. |
| CVE-2012-5360 | High | 2018-02-08 | Not applicable | No public exploit | Libavcodec in FFmpeg before 0.11 allows remote attackers to execute arbitrary code via a crafted QT file. |
| CVE-2012-5359 | High | 2018-02-08 | Not applicable | No public exploit | Libavcodec in FFmpeg before 0.11 allows remote attackers to execute arbitrary code via a crafted ASF file. |
| CVE-2018-6621 | Medium | 2018-02-05 | Not applicable | No public exploit | The decode_frame function in libavcodec/utvideodec.c in FFmpeg through 3.2 allows remote attackers to cause a denial of service (out of array read) via a crafted AVI file. |
| CVE-2018-6392 | Medium | 2018-01-29 | Not applicable | No public exploit | The filter_slice function in libavfilter/vf_transpose.c in FFmpeg through 3.4.1 allows remote attackers to cause a denial of service (out-of-array access) via a crafted MP4 file. |
| CVE-2015-1208 | Medium | 2018-01-09 | Not applicable | No public exploit | Integer underflow in the mov_read_default function in libavformat/mov.c in FFmpeg before 2.4.6 allows remote attackers to obtain sensitive information from heap and/or stack memory via a crafted MP4 file. |
| CVE-2017-1000460 | Medium | 2018-01-03 | Not applicable | No public exploit | In line libavcodec/h264dec.c:500 in libav(v13_dev0), ffmpeg(n3.4), chromium(56 prior Feb 13, 2017), the return value of init_get_bits is ignored and get_ue_golomb(&gb) is called on an uninitialized get_bits context, which causes a NULL deref exception. |
| CVE-2017-9608 | Medium | 2017-12-27 | Not applicable | No public exploit | The dnxhd decoder in FFmpeg before 3.2.6, and 3.3.x before 3.3.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted mov file. |
| CVE-2017-17555 | Medium | 2017-12-12 | Not applicable | No public exploit | The swri_audio_convert function in audioconvert.c in FFmpeg libswresample through 3.0.101, as used in FFmpeg 3.4.1, aubio 0.4.6, and other products, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted audio file. |
| CVE-2017-17081 | Medium | 2017-11-30 | Not applicable | No public exploit | The gmc_mmx function in libavcodec/x86/mpegvideodsp.c in FFmpeg 2.3 and 3.4 does not properly validate widths and heights, which allows remote attackers to cause a denial of service (integer signedness error and out-of-array read) via a crafted MPEG file. |
| CVE-2017-16840 | Critical | 2017-11-21 | Not applicable | No public exploit | The VC-2 Video Compression encoder in FFmpeg 3.0 and 3.4 allows remote attackers to cause a denial of service (out-of-bounds read) because of incorrect buffer padding for non-Haar wavelets, related to libavcodec/vc2enc.c and libavcodec/vc2enc_dwt.c. |
| CVE-2017-15672 | High | 2017-11-06 | Not applicable | No public exploit | The read_header function in libavcodec/ffv1dec.c in FFmpeg 2.4 and 3.3.4 and possibly earlier allows remote attackers to have unspecified impact via a crafted MP4 file, which triggers an out-of-bounds read. |
| CVE-2017-15186 | Medium | 2017-10-24 | Not applicable | No public exploit | Double free vulnerability in FFmpeg 3.3.4 and earlier allows remote attackers to cause a denial of service via a crafted AVI file. |
| CVE-2017-14767 | High | 2017-09-27 | Not applicable | No public exploit | The sdp_parse_fmtp_config_h264 function in libavformat/rtpdec_h264.c in FFmpeg before 3.3.4 mishandles empty sprop-parameter-sets values, which allows remote attackers to cause a denial of service (heap buffer overflow) or possibly have unspecified other impact via a crafted sdp file. |
| CVE-2017-14225 | High | 2017-09-09 | Not applicable | No public exploit | The av_color_primaries_name function in libavutil/pixdesc.c in FFmpeg 3.3.3 may return a NULL pointer depending on a value contained in a file, but callers do not anticipate this, as demonstrated by the avcodec_string function in libavcodec/utils.c, leading to a NULL pointer dereference. (It is also conceivable that there is security relevance for a NULL pointer dereference in av_color_primaries_name calls within the ffprobe command-line program.) |
| CVE-2017-14223 | Medium | 2017-09-09 | Not applicable | No public exploit | In libavformat/asfdec_f.c in FFmpeg 3.3.3, a DoS in asf_build_simple_index() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted ASF file, which claims a large "ict" field in the header but does not contain sufficient backing data, is provided, the for loop would consume huge CPU and memory resources, since there is no EOF check inside the loop. |
| CVE-2017-14222 | Medium | 2017-09-09 | Not applicable | No public exploit | In libavformat/mov.c in FFmpeg 3.3.3, a DoS in read_tfra() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted MOV file, which claims a large "item_count" field in the header but does not contain sufficient backing data, is provided, the loop would consume huge CPU and memory resources, since there is no EOF check inside the loop. |
| CVE-2017-14171 | Medium | 2017-09-07 | Not applicable | No public exploit | In libavformat/nsvdec.c in FFmpeg 2.4 and 3.3.3, a DoS in nsv_parse_NSVf_header() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted NSV file, which claims a large "table_entries_used" field in the header but does not contain sufficient backing data, is provided, the loop over 'table_entries_used' would consume huge CPU resources, since there is no EOF check inside the loop. |
| CVE-2017-14170 | Medium | 2017-09-07 | Not applicable | No public exploit | In libavformat/mxfdec.c in FFmpeg 3.3.3 -> 2.4, a DoS in mxf_read_index_entry_array() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted MXF file, which claims a large "nb_index_entries" field in the header but does not contain sufficient backing data, is provided, the loop would consume huge CPU resources, since there is no EOF check inside the loop. Moreover, this big loop can be invoked multiple times if there is more than one applicable data segment in the crafted MXF file. |
| CVE-2017-14169 | High | 2017-09-07 | Not applicable | No public exploit | In the mxf_read_primer_pack function in libavformat/mxfdec.c in FFmpeg 3.3.3 -> 2.4, an integer signedness error might occur when a crafted file, which claims a large "item_num" field such as 0xffffffff, is provided. As a result, the variable "item_num" turns negative, bypassing the check for a large value. |
| CVE-2017-14059 | Medium | 2017-08-31 | Not applicable | No public exploit | In FFmpeg 3.3.3, a DoS in cine_read_header() due to lack of an EOF check might cause huge CPU and memory consumption. When a crafted CINE file, which claims a large "duration" field in the header but does not contain sufficient backing data, is provided, the image-offset parsing loop would consume huge CPU and memory resources, since there is no EOF check inside the loop. |
| CVE-2017-14058 | Medium | 2017-08-31 | Not applicable | No public exploit | In FFmpeg 2.4 and 3.3.3, the read_data function in libavformat/hls.c does not restrict reload attempts for an insufficient list, which allows remote attackers to cause a denial of service (infinite loop). |
| CVE-2017-14057 | Medium | 2017-08-31 | Not applicable | No public exploit | In FFmpeg 3.3.3, a DoS in asf_read_marker() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted ASF file, which claims a large "name_len" or "count" field in the header but does not contain sufficient backing data, is provided, the loops over the name and markers would consume huge CPU and memory resources, since there is no EOF check inside these loops. |
| CVE-2017-14056 | Medium | 2017-08-31 | Not applicable | No public exploit | In libavformat/rl2.c in FFmpeg 3.3.3, a DoS in rl2_read_header() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted RL2 file, which claims a large "frame_count" field in the header but does not contain sufficient backing data, is provided, the loops (for offset and size tables) would consume huge CPU and memory resources, since there is no EOF check inside these loops. |
| CVE-2017-14055 | Medium | 2017-08-31 | Not applicable | No public exploit | In libavformat/mvdec.c in FFmpeg 3.3.3, a DoS in mv_read_header() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted MV file, which claims a large "nb_frames" field in the header but does not contain sufficient backing data, is provided, the loop over the frames would consume huge CPU and memory resources, since there is no EOF check inside the loop. |
| CVE-2017-14054 | Medium | 2017-08-31 | Not applicable | No public exploit | In libavformat/rmdec.c in FFmpeg 3.3.3, a DoS in ivr_read_header() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted IVR file, which claims a large "len" field in the header but does not contain sufficient backing data, is provided, the first type==4 loop would consume huge CPU resources, since there is no EOF check inside the loop. |
| CVE-2013-0870 | Critical | 2017-08-28 | Not applicable | No public exploit | The 'vp3_decode_frame' function in FFmpeg 1.1.4 moves threads check out of header packet type check. |
| CVE-2012-2805 | High | 2017-08-28 | Not applicable | No public exploit | Unspecified vulnerability in FFMPEG 0.10 allows remote attackers to cause a denial of service. |
| CVE-2012-2781 | Critical | 2017-08-09 | Not applicable | No public exploit | Unspecified vulnerability in FFmpeg before 0.10.3 has unknown impact and attack vectors, a different vulnerability than CVE-2012-2771, CVE-2012-2773, CVE-2012-2778, and CVE-2012-2780. |
| CVE-2012-2780 | Critical | 2017-08-09 | Not applicable | No public exploit | Unspecified vulnerability in FFmpeg before 0.10.3 has unknown impact and attack vectors, a different vulnerability than CVE-2012-2771, CVE-2012-2773, CVE-2012-2778, and CVE-2012-2781. |
| CVE-2012-2778 | Critical | 2017-08-09 | Not applicable | No public exploit | Unspecified vulnerability in FFmpeg before 0.10.3 has unknown impact and attack vectors, a different vulnerability than CVE-2012-2771, CVE-2012-2773, CVE-2012-2780, and CVE-2012-2781. |
| CVE-2012-2773 | Critical | 2017-08-09 | Not applicable | No public exploit | Unspecified vulnerability in FFmpeg before 0.10.3 has unknown impact and attack vectors, a different vulnerability than CVE-2012-2771, CVE-2012-2778, CVE-2012-2780, and CVE-2012-2781. |
| CVE-2012-2771 | Critical | 2017-08-09 | Not applicable | No public exploit | Unspecified vulnerability in FFmpeg before 0.10.3 has unknown impact and attack vectors, a different vulnerability than CVE-2012-2773, CVE-2012-2778, CVE-2012-2780, and CVE-2012-2781. |
| CVE-2017-11719 | High | 2017-07-28 | Not applicable | No public exploit | The dnxhd_decode_header function in libavcodec/dnxhddec.c in FFmpeg 3.0 through 3.3.2 allows remote attackers to cause a denial of service (out-of-array access) or possibly have unspecified other impact via a crafted DNxHD file. |
| CVE-2017-11665 | High | 2017-07-27 | Not applicable | No public exploit | The ff_amf_get_field_value function in libavformat/rtmppkt.c in FFmpeg 3.3.2 allows remote RTMP servers to cause a denial of service (Segmentation Violation and application crash) via a crafted stream. |
| CVE-2017-11399 | High | 2017-07-17 | Not applicable | No public exploit | Integer overflow in the ape_decode_frame function in libavcodec/apedec.c in FFmpeg 2.4 through 3.3.2 allows remote attackers to cause a denial of service (out-of-array access and application crash) or possibly have unspecified other impact via a crafted APE file. |
| CVE-2017-9996 | High | 2017-06-28 | Not applicable | No public exploit | The cdxl_decode_frame function in libavcodec/cdxl.c in FFmpeg 2.8.x before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 does not exclude the CHUNKY format, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file. |
| CVE-2017-9995 | High | 2017-06-28 | Not applicable | No public exploit | libavcodec/scpr.c in FFmpeg 3.3 before 3.3.1 does not properly validate height and width data, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file. |
| CVE-2017-9994 | High | 2017-06-28 | Not applicable | No public exploit | libavcodec/webp.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 does not ensure that pix_fmt is set, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file, related to the vp8_decode_mb_row_no_filter and pred8x8_128_dc_8_c functions. |
| CVE-2017-9993 | High | 2017-06-28 | Not applicable | No public exploit | FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data. |
| CVE-2017-9992 | High | 2017-06-28 | Not applicable | No public exploit | Heap-based buffer overflow in the decode_dds1 function in libavcodec/dfa.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file. |
| CVE-2017-9991 | High | 2017-06-28 | Not applicable | No public exploit | Heap-based buffer overflow in the xwd_decode_frame function in libavcodec/xwddec.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file. |
| CVE-2017-9990 | High | 2017-06-28 | Not applicable | No public exploit | Stack-based buffer overflow in the color_string_to_rgba function in libavcodec/xpmdec.c in FFmpeg 3.3 before 3.3.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file. |
| CVE-2017-7866 | Critical | 2017-04-14 | Not applicable | No public exploit | FFmpeg before 2017-01-23 has an out-of-bounds write caused by a stack-based buffer overflow related to the decode_zbuf function in libavcodec/pngdec.c. |
| CVE-2017-7865 | Critical | 2017-04-14 | Not applicable | No public exploit | FFmpeg before 2017-01-24 has an out-of-bounds write caused by a heap-based buffer overflow related to the ipvideo_decode_block_opcode_0xA function in libavcodec/interplayvideo.c and the avcodec_align_dimensions2 function in libavcodec/utils.c. |
| CVE-2017-7863 | Critical | 2017-04-14 | Not applicable | No public exploit | FFmpeg before 2017-02-04 has an out-of-bounds write caused by a heap-based buffer overflow related to the decode_frame_common function in libavcodec/pngdec.c. |
| CVE-2017-7862 | Critical | 2017-04-14 | Not applicable | No public exploit | FFmpeg before 2017-02-07 has an out-of-bounds write caused by a heap-based buffer overflow related to the decode_frame function in libavcodec/pictordec.c. |
| CVE-2017-7859 | Critical | 2017-04-14 | Not applicable | No public exploit | FFmpeg before 2017-03-05 has an out-of-bounds write caused by a heap-based buffer overflow related to the ff_h264_slice_context_init function in libavcodec/h264dec.c. |
| CVE-2012-5361 | High | 2017-03-20 | Not applicable | No public exploit | Libavcodec in FFmpeg before 0.11 allows remote attackers to execute arbitrary code via a crafted WMV file. |
| CVE-2016-10192 | Critical | 2017-02-09 | Not applicable | No public exploit | Heap-based buffer overflow in ffserver.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote attackers to execute arbitrary code by leveraging failure to check chunk size. |
| CVE-2016-10191 | Critical | 2017-02-09 | Not applicable | No public exploit | Heap-based buffer overflow in libavformat/rtmppkt.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote attackers to execute arbitrary code by leveraging failure to check for RTMP packet size mismatches. |
| CVE-2016-10190 | Critical | 2017-02-09 | Not applicable | No public exploit | Heap-based buffer overflow in libavformat/http.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote web servers to execute arbitrary code via a negative chunk size in an HTTP response. |
| CVE-2016-6920 | High | 2017-01-23 | Not applicable | No public exploit | Heap-based buffer overflow in the decode_block function in libavcodec/exr.c in FFmpeg before 3.1.3 allows remote attackers to cause a denial of service (application crash) via vectors involving tile positions. |
| CVE-2016-6164 | Critical | 2017-01-23 | Not applicable | No public exploit | Integer overflow in the mov_build_index function in libavformat/mov.c in FFmpeg before 2.8.8, 3.0.x before 3.0.3 and 3.1.x before 3.1.1 allows remote attackers to have unspecified impact via vectors involving sample size. |
| CVE-2016-9561 | Medium | 2016-12-23 | Not applicable | No public exploit | The che_configure function in libavcodec/aacdec_template.c in FFmpeg before 3.2.1 allows remote attackers to cause a denial of service (allocation of huge memory, and being killed by the OS) via a crafted MOV file. |
| CVE-2016-8595 | Medium | 2016-12-23 | Not applicable | No public exploit | The gsm_parse function in libavcodec/gsm_parser.c in FFmpeg before 3.1.5 allows remote attackers to cause a denial of service (assert fault) via a crafted AVI file. |
| CVE-2016-7905 | Medium | 2016-12-23 | Not applicable | No public exploit | The read_gab2_sub function in libavformat/avidec.c in FFmpeg before 3.1.4 allows remote attackers to cause a denial of service (NULL pointer used) via a crafted AVI file. |
| CVE-2016-7785 | Medium | 2016-12-23 | Not applicable | No public exploit | The avi_read_seek function in libavformat/avidec.c in FFmpeg before 3.1.4 allows remote attackers to cause a denial of service (assert fault) via a crafted AVI file. |
| CVE-2016-7562 | Medium | 2016-12-23 | Not applicable | No public exploit | The ff_draw_pc_font function in libavcodec/cga_data.c in FFmpeg before 3.1.4 allows remote attackers to cause a denial of service (buffer overflow) via a crafted AVI file. |
| CVE-2016-7555 | Medium | 2016-12-23 | Not applicable | No public exploit | The avi_read_header function in libavformat/avidec.c in FFmpeg before 3.1.4 is vulnerable to memory leak when decoding an AVI file that has a crafted "strh" structure. |
| CVE-2016-7502 | High | 2016-12-23 | Not applicable | No public exploit | The cavs_idct8_add_c function in libavcodec/cavsdsp.c in FFmpeg before 3.1.4 is vulnerable to reading out-of-bounds memory when decoding with cavs_decode. |