CVE-2014-8542

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

libavcodec/utils.c in FFmpeg before 2.4.2 omits a certain codec ID during enforcement of alignment, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted JV data.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=105654e376a736d243aef4a1d121abebce912e6b
http://www.ffmpeg.org/security.htmlVendor Advisory
http://www.ubuntu.com/usn/USN-2534-1Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/02/msg00005.htmlThird Party Advisory
https://security.gentoo.org/glsa/201603-06Third Party Advisory
http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=105654e376a736d243aef4a1d121abebce912e6b
http://www.ffmpeg.org/security.htmlVendor Advisory
http://www.ubuntu.com/usn/USN-2534-1Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/02/msg00005.htmlThird Party Advisory
https://security.gentoo.org/glsa/201603-06Third Party Advisory

Timeline

Published: Nov 5, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-85437.5libavcodec/mmvideo.c in FFmpeg before 2.4.2 does not consider all lines of HHV Intra blocks during validation of image height, which allows CVE-2014-85447.5libavcodec/tiff.c in FFmpeg before 2.4.2 does not properly validate bits-per-pixel fields, which allows remote attackers to cause a denial o CVE-2014-85457.5libavcodec/pngdec.c in FFmpeg before 2.4.2 accepts the monochrome-black format without verifying that the bits-per-pixel value is 1, which a CVE-2014-85467.5Integer underflow in libavcodec/cinepak.c in FFmpeg before 2.4.2 allows remote attackers to cause a denial of service (out-of-bounds access)CVE-2014-85477.5libavcodec/gifdec.c in FFmpeg before 2.4.2 does not properly compute image heights, which allows remote attackers to cause a denial of servi CVE-2014-85487.5Off-by-one error in libavcodec/smc.c in FFmpeg before 2.4.2 allows remote attackers to cause a denial of service (out-of-bounds access) or p CVE-2014-85497.5libavcodec/on2avc.c in FFmpeg before 2.4.2 does not constrain the number of channels to at most 2, which allows remote attackers to cause a CVE-2014-855110.0The WinCC server in Siemens SIMATIC WinCC 7.0 through SP3, 7.2 before Update 9, and 7.3 before Update 2; SIMATIC PCS 7 7.1 through SP4, 8.0 CVE-2014-85525.0The WinCC server in Siemens SIMATIC WinCC 7.0 through SP3, 7.2 before Update 9, and 7.3 before Update 2; SIMATIC PCS 7 7.1 through SP4, 8.0 CVE-2014-85535.0The mci_account_get_array_by_id function in api/soap/mc_account_api.php in MantisBT before 1.2.18 allows remote attackers to obtain sensitiv CVE-2014-85547.5SQL injection vulnerability in the mc_project_get_attachments function in api/soap/mc_project_api.php in MantisBT before 1.2.18 allows remot CVE-2014-85555.0Directory traversal vulnerability in report/reportViewAction.jsp in Progress Software OpenEdge 11.2 allows remote attackers to read arbitrar