CVE-2014-2263
The mpegts_write_pmt function in the MPEG2 transport stream (aka DVB) muxer (libavformat...
CVE-2014-2263 is a medium vulnerability (CVSS 6.8) in Ffmpeg, published February 28, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.26%, the 83rd percentile. Fixed in ffmpeg 7:2.4.1-1.
- Severity
- 6.8 MediumCVSS 2.0, NVD
- Exploit chance
- 2.26%EPSS, 83rd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
7:2.4.1-1ffmpeg +7 more
Description
The mpegts_write_pmt function in the MPEG2 transport stream (aka DVB) muxer (libavformat/mpegtsenc.c) in FFmpeg, possibly 2.1 and earlier, allows remote attackers to have unspecified impact and vectors, which trigger an out-of-bounds write.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ffmpegDebian:12 | before 7:2.4.1-1 | 7:2.4.1-1 |
ffmpegDebian:13 | before 7:2.4.1-1 | 7:2.4.1-1 |
ffmpegDebian:14 | before 7:2.4.1-1 | 7:2.4.1-1 |
libavDebian:7 From an advisory covering 11 CVEs | before 6:0.8.15-1, plus listed versions 6:0.8.10-16:0.8.12-16:0.8.13-16:0.8.6-16:0.8.7-16:0.8.8-16:0.8.9-1 | 6:0.8.15-1 |
ffmpegMageia:4 From an advisory covering 5 CVEs | before 2.0.5-1.mga4 | 2.0.5-1.mga4 |
ffmpegMageia:4 From an advisory covering 5 CVEs | before 2.0.5-1.mga4.tainted | 2.0.5-1.mga4.tainted |
ffmpegMageia:3 From an advisory covering 6 CVEs | before 1.1.12-1.mga3 | 1.1.12-1.mga3 |
ffmpegMageia:3 From an advisory covering 6 CVEs | before 1.1.12-1.mga3.tainted | 1.1.12-1.mga3.tainted |
What each source reports
NVD Score used
The mpegts_write_pmt function in the MPEG2 transport stream (aka DVB) muxer (libavformat/mpegtsenc.c) in FFmpeg, possibly 2.1 and earlier, allows remote attackers to have unspecified impact and vectors, which trigger an out-of-bounds write.
- Record
CVE-2014-2263- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE ListNo score
The mpegts_write_pmt function in the MPEG2 transport stream (aka DVB) muxer (libavformat/mpegtsenc.c) in FFmpeg, possibly 2.1 and earlier, allows remote attackers to have unspecified impact and vectors, which trigger an out-of-bounds write.
- Record
CVE-2014-2263- Updated
- 2026-11-02
EUVDEUVD-2014-2301No score
The mpegts_write_pmt function in the MPEG2 transport stream (aka DVB) muxer (libavformat/mpegtsenc.c) in FFmpeg, possibly 2.1 and earlier, allows remote attackers to have unspecified impact and vectors, which trigger an out-of-bounds write.
- Record
EUVD-2014-2301- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rp6v-pvvg-9g84No score
The mpegts_write_pmt function in the MPEG2 transport stream (aka DVB) muxer (libavformat...
The mpegts_write_pmt function in the MPEG2 transport stream (aka DVB) muxer (libavformat/mpegtsenc.c) in FFmpeg, possibly 2.1 and earlier, allows remote attackers to have unspecified impact and vectors, which trigger an out-of-bounds write.
- Record
GHSA-rp6v-pvvg-9g84- Weakness
- CWE-119
- Updated
- 2026-11-02
OSVNo score
The mpegts_write_pmt function in the MPEG2 transport stream (aka DVB) muxer (libavformat/mpegtsenc.c) in FFmpeg, possibly 2.1 and earlier, allows remote attackers to have unspecified impact and vectors, which trigger an out-of-bounds write.
- Record
CVE-2014-2263- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-2263No score
The mpegts_write_pmt function in the MPEG2 transport stream (aka DVB) muxer (libavformat/mpegtsenc.c) in FFmpeg, possibly 2.1 and earlier, allows remote attackers to have unspecified impact and vectors, which trigger an out-of-bounds write.
- Record
DEBIAN-CVE-2014-2263- Updated
- 2026-11-02
OSVMGASA-2014-0280No score
Updated ffmpeg packages fix security vulnerabilities
The tak_decode_frame function in libavcodec/takdec.c in FFmpeg before 2.0.4 does not properly validate a certain bits-per-sample value, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted TAK (aka Tom's lossless Audio Kompressor) data (CVE-2014-2097).
libavcodec/wmalosslessdec.c in FFmpeg before 2.0.4 uses an incorrect data-structure size for certain coefficients, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted WMA data (CVE-2014-2098).
The msrle_decode_frame function in libavcodec/msrle.c in FFmpeg before 2.0.4 does not properly calculate line sizes, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Microsoft RLE video data (CVE-2014-2099).
The mpegts_write_pmt function in the MPEG2 transport stream (aka DVB) muxer (libavformat/mpegtsenc.c) in FFmpeg before 2.0.4 allows remote attackers to have unspecified impact and vectors, which trigger an out-of-bounds write (CVE-2014-2263).
An integer overflow in LZO decompression in FFmpeg before 2.0.5 allows remote attackers to have an unspecified impact by embedding compressed data in a video file (CVE-2014-4610).
This updates provides ffmpeg version 2.0.5, which fixes these issues and several other bugs which were corrected upstream.
- Record
MGASA-2014-0280- Updated
- 2026-11-02
OSVMGASA-2014-0281No score
Updated ffmpeg packages fix security vulnerabilities
A use-after-free vulnerability in FFmpeg before 1.1.9 involving seek operations on video data could allow remote attackers to cause a denial of service (CVE-2012-5150).
The tak_decode_frame function in libavcodec/takdec.c in FFmpeg before 1.1.9 does not properly validate a certain bits-per-sample value, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted TAK (aka Tom's lossless Audio Kompressor) data (CVE-2014-2097).
libavcodec/wmalosslessdec.c in FFmpeg before 1.1.9 uses an incorrect data-structure size for certain coefficients, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted WMA data (CVE-2014-2098).
The msrle_decode_frame function in libavcodec/msrle.c in FFmpeg before 1.1.9 does not properly calculate line sizes, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Microsoft RLE video data (CVE-2014-2099).
The mpegts_write_pmt function in the MPEG2 transport stream (aka DVB) muxer (libavformat/mpegtsenc.c) in FFmpeg before 1.1.9 allows remote attackers to have unspecified impact and vectors, which trigger an out-of-bounds write (CVE-2014-2263).
An integer overflow in LZO decompression in FFmpeg before 1.1.12 allows remote attackers to have an unspecified impact by embedding compressed data in a video file (CVE-2014-4610).
This updates provides ffmpeg version 1.1.12, which fixes these issues and several other bugs which were corrected upstream.
- Record
MGASA-2014-0281- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
git.videolan.org?p=ffmpeg.git%3Ba=commit%3Bh=842b6c14bc
secunia.com/advisories/56971
securitytracker.com/id/1029850
exchange.xforce.ibmcloud.com/vulnerabilities/91174
security.gentoo.org/glsa/201603-06
securityfocus.com/bid/65560
Show 13 moreShow less
nvd.nist.gov/vuln/detail/CVE-2014-2263
github.com/advisories/GHSA-rp6v-pvvg-9g84
security-tracker.debian.org/tracker/CVE-2014-2263
advisories.mageia.org/MGASA-2014-0280.html
bugs.mageia.org/show_bug.cgi?id=13594
ffmpeg.org/olddownload.html
openwall.com/lists/oss-security/2014/06/26/23