CVE-2014-2097

Published: 2 March 2014

The tak_decode_frame function in libavcodec/takdec.c in FFmpeg before 2.1.4 does not properly validate a certain bits-per-sample value, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted TAK (aka Tom's lossless Audio Kompressor) data.

Priority

Status

Package	Release	Status
ffmpeg Launchpad, Ubuntu, Debian	lucid	Ignored (end of life)
	precise	Does not exist
	quantal	Does not exist
	saucy	Does not exist
	upstream	Needs triage

References

http://git.videolan.org/?p=ffmpeg.git;a=commit;h=f58eab151214d2d35ff0973f2b3e51c5eb372da4
https://www.cve.org/CVERecord?id=CVE-2014-2097
NVD
Launchpad
Debian

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.