The ff_mjpeg_decode_sof function in libavcodec/mjpegdec.c in FFmpeg before 2.5.4 does not validate the number of components in a JPEG-LS Start Of Frame segment, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Motion JPEG data.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The ff_mjpeg_decode_sof function in libavcodec/mjpegdec.c in FFmpeg before 2.5.4 does not validate the     number of components in a JPEG-LS Start Of Frame segment, which allows remote attackers to cause a denial     of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Motion JPEG     data. (CVE-2015-1872)

Note that Nessus relies on the presence of the package as reported by the vendor.

Several security issues have been corrected in multiple demuxers and decoders of the libav multimedia library.

CVE-2015-1872

The ff_mjpeg_decode_sof function in libavcodec/mjpegdec.c did not validate the number of components in a JPEG-LS Start Of Frame segment, which allowed remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Motion JPEG data.

CVE-2017-14058

The read_data function in libavformat/hls.c did not restrict reload attempts for an insufficient list, which allowed remote attackers to cause a denial of service (infinite loop).

CVE-2017-1000460

In get_last_needed_nal() (libavformat/h264.c) the return value of init_get_bits was ignored and get_ue_golomb(&gb) was called on an uninitialized get_bits context, which caused a NULL deref exception.

CVE-2018-6392

The filter_slice function in libavfilter/vf_transpose.c allowed remote attackers to cause a denial of service (out-of-array access) via a crafted MP4 file.

CVE-2018-1999012

libav contained a CWE-835: Infinite loop vulnerability in pva format demuxer that could result in a vulnerability that allowed attackers to consume excessive amount of resources like CPU and RAM. This attack appeared to be exploitable via specially crafted PVA file had to be provided as input.

For Debian 8 'Jessie', these problems have been fixed in version 6:11.12-1~deb8u6.

We recommend that you upgrade your libav packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities have been found in libav :

CVE-2015-1872

The ff_mjpeg_decode_sof function in libavcodec/mjpegdec.c in Libav before 0.8.18 does not validate the number of components in a JPEG-LS Start Of Frame segment, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Motion JPEG data.

CVE-2015-5479

The ff_h263_decode_mba function in libavcodec/ituh263dec.c in Libav before 11.5 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a file with crafted dimensions.

CVE-2016-7393

The aac_sync function in libavcodec/aac_parser.c in Libav before 11.5 is vulnerable to a stack-based buffer overflow.

For Debian 7 'Wheezy', these problems have been fixed in version 6:0.8.18-0+deb7u1.

We recommend that you upgrade your libav packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that Libav incorrectly handled certain malformed media files. If a user were tricked into opening a crafted media file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Please reference CVE/URL list for details

The Mageia project reports :

Avidemux is built with a bundled set of FFmpeg libraries. The bundled FFmpeg version has been updated from 1.2.10 to 1.2.12 to fix these security issues and other bugs fixed upstream in FFmpeg.

ID	Name	Product	Family	Severity
254905	Linux Distros Unpatched Vulnerability : CVE-2015-1872	Nessus	Misc.	high
123527	Debian DLA-1740-1 : libav security update	Nessus	Debian Local Security Checks	medium
93847	Debian DLA-644-1 : libav security update	Nessus	Debian Local Security Checks	medium
90349	Ubuntu 12.04 LTS : libav vulnerabilities (USN-2944-1)	Nessus	Ubuntu Local Security Checks	high
83940	FreeBSD : ffmpeg -- multiple vulnerabilities (65b14d39-d01f-419c-b0b8-5df60b929973)	Nessus	FreeBSD Local Security Checks	high
83939	FreeBSD : avidemux26 -- multiple vulnerabilities in bundled FFmpeg (022255be-0895-11e5-a242-5404a68ad561)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2015-1872

high

Tenable Plugins

high

medium

medium

high

high

high