FFmpeg 'libavcodec/mjpegdec. c' cross-border Denial of Service Vulnerability

FFmpeg 'libavcodec/mjpegdec. c' cross-border Denial of Service Vulnerability

Release date:
Updated on:

Affected Systems:
FFmpeg 2.x
Description:
Bugtraq id: 71616
CVE (CAN) ID: CVE-2014-9316

FFmpeg is a free software that allows you to perform video, transfer, and stream functions in multiple formats of audio and video. Libav is a cross-platform free software that allows you to perform video, transfer, and stream functions in multimedia formats and protocols.

Versions earlier than FFMpeg 2.1.6, 2.2.x-2.3.x, and 2.4.4, libavcodec/mjpegdec. c's m1__decode_app function has a denial of service vulnerability. Remote attackers can exploit this vulnerability to cause a denial of service by using the LJIF tag related methods of the MJPEG file.

<* Source: Mateusz "j00ru" Jurczyk
Gynvael Coldwind
*>

Suggestion:
Vendor patch:

FFmpeg
------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://ffmpeg.org/security.html
Http://git.videolan.org /? P = ffmpeg. git; a = commit; h = 0eecf40935b22644e6cd74c586057237ecfd6844

Compile FFmpeg in Linux to download and compile the source file

Linux compiling and upgrading FFmpeg

Install FFMPEG on CentOS 5.6

Install FFmpeg in Ubuntu

Compile ffmpeg in Ubuntu 12.04

Install FFmpeg 2.2.2 In PPA in Ubuntu 14.04

FFmpeg details: click here
FFmpeg: click here

This article permanently updates the link address: