CVE-2014-2097
The tak_decode_frame function in libavcodec/takdec.c in FFmpeg before 2.1.4 does not properly...
The tak_decode_frame function in libavcodec/takdec.c in FFmpeg before 2.1.4 does not properly validate a certain bits-per-sample value, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted TAK (aka Tom's lossless Audio Kompressor) data.
Exploit likelihood
What each source reports
NVD Score used
The tak_decode_frame function in libavcodec/takdec.c in FFmpeg before 2.1.4 does not properly validate a certain bits-per-sample value, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted TAK (aka Tom's lossless Audio Kompressor) data.
- Record
CVE-2014-2097- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The tak_decode_frame function in libavcodec/takdec.c in FFmpeg before 2.1.4 does not properly validate a certain bits-per-sample value, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted TAK (aka Tom's lossless Audio Kompressor) data.
- Record
CVE-2014-2097- Updated
- 2026-11-02
EUVDEUVD-2014-2137 No score
The tak_decode_frame function in libavcodec/takdec.c in FFmpeg before 2.1.4 does not properly validate a certain bits-per-sample value, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted TAK (aka Tom's lossless Audio Kompressor) data.
- Record
EUVD-2014-2137- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x9v4-qjjx-qmxp No score
The tak_decode_frame function in libavcodec/takdec.c in FFmpeg before 2.1.4 does not properly...
The tak_decode_frame function in libavcodec/takdec.c in FFmpeg before 2.1.4 does not properly validate a certain bits-per-sample value, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted TAK (aka Tom's lossless Audio Kompressor) data.
- Record
GHSA-x9v4-qjjx-qmxp- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVMGASA-2014-0280 No score
Updated ffmpeg packages fix security vulnerabilities
The tak_decode_frame function in libavcodec/takdec.c in FFmpeg before 2.0.4 does not properly validate a certain bits-per-sample value, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted TAK (aka Tom's lossless Audio Kompressor) data (CVE-2014-2097).
libavcodec/wmalosslessdec.c in FFmpeg before 2.0.4 uses an incorrect data-structure size for certain coefficients, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted WMA data (CVE-2014-2098).
The msrle_decode_frame function in libavcodec/msrle.c in FFmpeg before 2.0.4 does not properly calculate line sizes, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Microsoft RLE video data (CVE-2014-2099).
The mpegts_write_pmt function in the MPEG2 transport stream (aka DVB) muxer (libavformat/mpegtsenc.c) in FFmpeg before 2.0.4 allows remote attackers to have unspecified impact and vectors, which trigger an out-of-bounds write (CVE-2014-2263).
An integer overflow in LZO decompression in FFmpeg before 2.0.5 allows remote attackers to have an unspecified impact by embedding compressed data in a video file (CVE-2014-4610).
This updates provides ffmpeg version 2.0.5, which fixes these issues and several other bugs which were corrected upstream.
- Record
MGASA-2014-0280- Updated
- 2026-11-02
OSVMGASA-2014-0281 No score
Updated ffmpeg packages fix security vulnerabilities
A use-after-free vulnerability in FFmpeg before 1.1.9 involving seek operations on video data could allow remote attackers to cause a denial of service (CVE-2012-5150).
The tak_decode_frame function in libavcodec/takdec.c in FFmpeg before 1.1.9 does not properly validate a certain bits-per-sample value, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted TAK (aka Tom's lossless Audio Kompressor) data (CVE-2014-2097).
libavcodec/wmalosslessdec.c in FFmpeg before 1.1.9 uses an incorrect data-structure size for certain coefficients, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted WMA data (CVE-2014-2098).
The msrle_decode_frame function in libavcodec/msrle.c in FFmpeg before 1.1.9 does not properly calculate line sizes, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Microsoft RLE video data (CVE-2014-2099).
The mpegts_write_pmt function in the MPEG2 transport stream (aka DVB) muxer (libavformat/mpegtsenc.c) in FFmpeg before 1.1.9 allows remote attackers to have unspecified impact and vectors, which trigger an out-of-bounds write (CVE-2014-2263).
An integer overflow in LZO decompression in FFmpeg before 1.1.12 allows remote attackers to have an unspecified impact by embedding compressed data in a video file (CVE-2014-4610).
This updates provides ffmpeg version 1.1.12, which fixes these issues and several other bugs which were corrected upstream.
- Record
MGASA-2014-0281- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ffmpegMageia:4 From an advisory covering 5 CVEs |
before 2.0.5-1.mga4 | 2.0.5-1.mga4 |
ffmpegMageia:4 From an advisory covering 5 CVEs |
before 2.0.5-1.mga4.tainted | 2.0.5-1.mga4.tainted |
ffmpegMageia:3 From an advisory covering 6 CVEs |
before 1.1.12-1.mga3 | 1.1.12-1.mga3 |
ffmpegMageia:3 From an advisory covering 6 CVEs |
before 1.1.12-1.mga3.tainted | 1.1.12-1.mga3.tainted |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-2097 is a medium vulnerability (CVSS 6.8) in Ffmpeg, published March 2, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.21%, the 68th percentile. No source names a fixed version.
References
git.videolan.org?p=ffmpeg.git%3Ba=commit%3Bh=f58eab151214d2d35ff0973f2b3e51c5eb372da4
security.gentoo.org/glsa/201603-06
nvd.nist.gov/vuln/detail/CVE-2014-2097
github.com/advisories/GHSA-x9v4-qjjx-qmxp
advisories.mageia.org/MGASA-2014-0280.html
Show 8 moreShow less
bugs.mageia.org/show_bug.cgi?id=13594
ffmpeg.org/olddownload.html
openwall.com/lists/oss-security/2014/06/26/23