CVE-2014-5271: Buffer Overflow

Q: What is the severity of CVE-2014-5271?

CVE-2014-5271 has a high severity rating due to the potential for remote code execution and denial of service.

Q: How do I fix CVE-2014-5271?

To fix CVE-2014-5271, upgrade to FFmpeg version 1.1.14 or later, 1.2.8 or later, 2.2.7 or later, or 2.3.3 or later, or update to Libav version 10.5 or higher.

Q: Which versions of FFmpeg are affected by CVE-2014-5271?

CVE-2014-5271 affects FFmpeg versions before 1.1.14, 1.2.x before 1.2.8, 2.x before 2.2.7, and 2.3.x before 2.3.3.

Q: Which versions of Libav are affected by CVE-2014-5271?

CVE-2014-5271 affects Libav versions prior to 10.5.

Q: What type of vulnerability is CVE-2014-5271?

CVE-2014-5271 is a heap-based buffer overflow vulnerability that can lead to crashes or remote code execution.

Published Nov 3, 2014

Updated

Heap-based buffer overflow in the encodeslice function in libavcodec/proresenckostya.c in FFMpeg before 1.1.14, 1.2.x before 1.2.8, 2.x before 2.2.7, and 2.3.x before 2.3.3 and Libav before 10.5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors.

Affected Software

79 affected components

FFmpeg FFmpeg<=1.1.13

FFmpeg FFmpeg=1.1

FFmpeg FFmpeg=1.1.1

FFmpeg FFmpeg=1.1.2

FFmpeg FFmpeg=1.1.3

FFmpeg FFmpeg=1.1.4

FFmpeg FFmpeg=1.1.5

FFmpeg FFmpeg=1.1.6

FFmpeg FFmpeg=1.1.7

FFmpeg FFmpeg=1.1.8

FFmpeg FFmpeg=1.1.9

FFmpeg FFmpeg=1.1.10

FFmpeg FFmpeg=1.1.11

FFmpeg FFmpeg=1.1.12

FFmpeg FFmpeg=1.2

FFmpeg FFmpeg=1.2.1

FFmpeg FFmpeg=1.2.3

FFmpeg FFmpeg=1.2.4

FFmpeg FFmpeg=1.2.5

FFmpeg FFmpeg=1.2.6

FFmpeg FFmpeg=1.2.7

FFmpeg FFmpeg=2.0

FFmpeg FFmpeg=2.0.1

FFmpeg FFmpeg=2.0.2

FFmpeg FFmpeg=2.0.3

FFmpeg FFmpeg=2.0.4

FFmpeg FFmpeg=2.0.5

FFmpeg FFmpeg=2.1

FFmpeg FFmpeg=2.1.1

FFmpeg FFmpeg=2.1.2

FFmpeg FFmpeg=2.1.3

FFmpeg FFmpeg=2.1.4

FFmpeg FFmpeg=2.1.5

FFmpeg FFmpeg=2.2

FFmpeg FFmpeg=2.2.4

FFmpeg FFmpeg=2.3

FFmpeg FFmpeg=2.3.2

Libav Libav<=10.4

Libav Libav=0.5

Libav Libav=0.5.1

Libav Libav=0.5.2

Libav Libav=0.5.3

Libav Libav=0.5.4

Libav Libav=0.5.5

Libav Libav=0.5.6

Libav Libav=0.5.7

Libav Libav=0.5.8

Libav Libav=0.6

Libav Libav=0.6.1

Libav Libav=0.6.2

Libav Libav=0.6.3

Libav Libav=0.6.4

Libav Libav=0.6.5

Libav Libav=0.7

Libav Libav=0.7-beta1

Libav Libav=0.7-beta2

Libav Libav=0.7.1

Libav Libav=0.7.2

Libav Libav=0.7.3

Libav Libav=0.7.4

Libav Libav=0.7.5

Libav Libav=0.7.6

Libav Libav=0.8

Libav Libav=0.8-beta2

Libav Libav=0.8.1

Libav Libav=0.8.2

Libav Libav=0.8.3

Libav Libav=0.8.4

Libav Libav=0.8.5

Libav Libav=0.8.6

Libav Libav=0.8.7

Libav Libav=0.8.8

Libav Libav=0.8.9

Libav Libav=0.8.10

Libav Libav=0.8.11

Libav Libav=0.8.12

Libav Libav=10.1

Libav Libav=10.2

Libav Libav=10.3

Event History

Nov 3, 2014

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-5271?

CVE-2014-5271 has a high severity rating due to the potential for remote code execution and denial of service.

How do I fix CVE-2014-5271?

To fix CVE-2014-5271, upgrade to FFmpeg version 1.1.14 or later, 1.2.8 or later, 2.2.7 or later, or 2.3.3 or later, or update to Libav version 10.5 or higher.

Which versions of FFmpeg are affected by CVE-2014-5271?