Overview
- Description
- The jpeg2000_read_main_headers function in libavcodec/jpeg2000dec.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 does not enforce uniqueness of the SIZ marker in a JPEG 2000 image, which allows remote attackers to cause a denial of service (out-of-bounds heap-memory access) or possibly have unspecified other impact via a crafted image with two or more of these markers.
- Source
- cve@mitre.org
- NVD status
- Modified
Risk scores
CVSS 2.0
- Type
- Primary
- Base score
- 6.8
- Impact score
- 6.4
- Exploitability score
- 8.6
- Vector string
- AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
- nvd@nist.gov
- CWE-119
Social media
- Hype score
- Not currently trending
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:2.6.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3EE84614-E84C-496D-933C-5BEFD385451B"
},
{
"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:2.7.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FA690A40-7E16-4E19-9A8E-CC2B41C58921"
},
{
"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:2.7.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8D3F7BF7-D609-44B1-9536-4A07DC149824"
},
{
"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:2.7.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CBD5E478-1654-4A75-904D-8453DDC680A0"
},
{
"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:2.8.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E263E4FD-B683-4233-AFDC-07C72DDA80DC"
},
{
"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:2.8.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AA3F5FAA-AD9E-4FC1-B91C-E9A561E95173"
},
{
"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:2.8.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "18A269C0-FE0F-4178-8195-955D373D9055"
}
],
"operator": "OR"
}
]
}
]