{"id":"CVE-2014-2097","aliases":["EUVD-2014-2137","GHSA-x9v4-qjjx-qmxp","MGASA-2014-0280","MGASA-2014-0281"],"status":"published","title":"The tak_decode_frame function in libavcodec/takdec.c in FFmpeg before 2.1.4 does not properly...","description":"The tak_decode_frame function in libavcodec/takdec.c in FFmpeg before 2.1.4 does not properly validate a certain bits-per-sample value, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted TAK (aka Tom's lossless Audio Kompressor) data.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01215,"percentile":0.68735,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-20"],"published":"2014-03-02T02:00:00Z","modified":"2026-06-17T00:06:03Z","affected":[{"source":"osv","ecosystem":"Mageia:4","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.5-1.mga4"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:4","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.5-1.mga4.tainted"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:3","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.12-1.mga3"}]}],"bundled":6},{"source":"osv","ecosystem":"Mageia:3","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.12-1.mga3.tainted"}]}],"bundled":6}],"products":[{"vendor":"ffmpeg","product":"ffmpeg"}],"references":[{"url":"http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=f58eab151214d2d35ff0973f2b3e51c5eb372da4","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://security.gentoo.org/glsa/201603-06","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-2097"},{"url":"http://git.videolan.org/?p=ffmpeg.git;a=commit;h=f58eab151214d2d35ff0973f2b3e51c5eb372da4"},{"url":"https://github.com/advisories/GHSA-x9v4-qjjx-qmxp"},{"url":"https://advisories.mageia.org/MGASA-2014-0280.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13594","tags":["report"]},{"url":"http://git.videolan.org/?p=ffmpeg.git;a=log;h=n2.0.5","tags":["web"]},{"url":"http://ffmpeg.org/olddownload.html","tags":["web"]},{"url":"http://ffmpeg.org/security.html","tags":["web"]},{"url":"http://openwall.com/lists/oss-security/2014/06/26/23","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2014-0281.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13595","tags":["report"]},{"url":"http://git.videolan.org/?p=ffmpeg.git;a=log;h=n1.1.12","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-2097","description":"The tak_decode_frame function in libavcodec/takdec.c in FFmpeg before 2.1.4 does not properly validate a certain bits-per-sample value, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted TAK (aka Tom's lossless Audio Kompressor) data.","status":"published","published":"2014-03-02T02:00:00Z","modified":"2024-08-06T10:05:59.632Z","updated_at":"2026-11-02T14:33:43.566796Z"}],"euvd":[{"id":"EUVD-2014-2137","description":"The tak_decode_frame function in libavcodec/takdec.c in FFmpeg before 2.1.4 does not properly validate a certain bits-per-sample value, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted TAK (aka Tom's lossless Audio Kompressor) data.","status":"published","published":"2014-03-02T02:00:00Z","modified":"2024-08-06T10:05:59Z","updated_at":"2026-11-03T01:57:15.270389Z"}],"ghsa":[{"id":"GHSA-x9v4-qjjx-qmxp","title":"The tak_decode_frame function in libavcodec/takdec.c in FFmpeg before 2.1.4 does not properly...","description":"The tak_decode_frame function in libavcodec/takdec.c in FFmpeg before 2.1.4 does not properly validate a certain bits-per-sample value, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted TAK (aka Tom's lossless Audio Kompressor) data.","status":"published","published":"2022-05-17T03:34:41Z","modified":"2025-04-12T12:32:05Z","cwes":["CWE-20"],"updated_at":"2026-11-02T15:01:16.95233Z"}],"nvd":[{"id":"CVE-2014-2097","description":"The tak_decode_frame function in libavcodec/takdec.c in FFmpeg before 2.1.4 does not properly validate a certain bits-per-sample value, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted TAK (aka Tom's lossless Audio Kompressor) data.","status":"published","published":"2014-03-02T04:57:25.807Z","modified":"2026-06-17T00:06:03.907Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:53.330367Z"}],"osv":[{"id":"MGASA-2014-0280","title":"Updated ffmpeg packages fix security vulnerabilities","description":"The tak_decode_frame function in libavcodec/takdec.c in FFmpeg before\n2.0.4 does not properly validate a certain bits-per-sample value, which\nallows remote attackers to cause a denial of service (out-of-bounds array\naccess) or possibly have unspecified other impact via crafted TAK (aka\nTom's lossless Audio Kompressor) data (CVE-2014-2097).\n\nlibavcodec/wmalosslessdec.c in FFmpeg before 2.0.4 uses an incorrect\ndata-structure size for certain coefficients, which allows remote\nattackers to cause a denial of service (memory corruption) or possibly\nhave unspecified other impact via crafted WMA data (CVE-2014-2098).\n\nThe msrle_decode_frame function in libavcodec/msrle.c in FFmpeg before\n2.0.4 does not properly calculate line sizes, which allows remote\nattackers to cause a denial of service (out-of-bounds array access) or\npossibly have unspecified other impact via crafted Microsoft RLE video\ndata (CVE-2014-2099).\n\nThe mpegts_write_pmt function in the MPEG2 transport stream (aka DVB)\nmuxer (libavformat/mpegtsenc.c) in FFmpeg before 2.0.4 allows remote\nattackers to have unspecified impact and vectors, which trigger an\nout-of-bounds write (CVE-2014-2263).\n\nAn integer overflow in LZO decompression in FFmpeg before 2.0.5 allows\nremote attackers to have an unspecified impact by embedding compressed\ndata in a video file (CVE-2014-4610).\n\nThis updates provides ffmpeg version 2.0.5, which fixes these issues\nand several other bugs which were corrected upstream.\n","status":"published","published":"2014-07-04T18:14:30Z","modified":"2026-04-16T06:22:27.954745308Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"MGASA-2014-0281","title":"Updated ffmpeg packages fix security vulnerabilities","description":"A use-after-free vulnerability in FFmpeg before 1.1.9 involving seek\noperations on video data could allow remote attackers to cause a denial\nof service (CVE-2012-5150).\n\nThe tak_decode_frame function in libavcodec/takdec.c in FFmpeg before\n1.1.9 does not properly validate a certain bits-per-sample value, which\nallows remote attackers to cause a denial of service (out-of-bounds array\naccess) or possibly have unspecified other impact via crafted TAK (aka\nTom's lossless Audio Kompressor) data (CVE-2014-2097).\n\nlibavcodec/wmalosslessdec.c in FFmpeg before 1.1.9 uses an incorrect\ndata-structure size for certain coefficients, which allows remote\nattackers to cause a denial of service (memory corruption) or possibly\nhave unspecified other impact via crafted WMA data (CVE-2014-2098).\n\nThe msrle_decode_frame function in libavcodec/msrle.c in FFmpeg before\n1.1.9 does not properly calculate line sizes, which allows remote\nattackers to cause a denial of service (out-of-bounds array access) or\npossibly have unspecified other impact via crafted Microsoft RLE video\ndata (CVE-2014-2099).\n\nThe mpegts_write_pmt function in the MPEG2 transport stream (aka DVB)\nmuxer (libavformat/mpegtsenc.c) in FFmpeg before 1.1.9 allows remote\nattackers to have unspecified impact and vectors, which trigger an\nout-of-bounds write (CVE-2014-2263).\n\nAn integer overflow in LZO decompression in FFmpeg before 1.1.12 allows\nremote attackers to have an unspecified impact by embedding compressed\ndata in a video file (CVE-2014-4610).\n\nThis updates provides ffmpeg version 1.1.12, which fixes these issues\nand several other bugs which were corrected upstream.\n","status":"published","published":"2014-07-04T18:22:12Z","modified":"2026-04-16T06:25:50.393962161Z","updated_at":"2026-11-02T15:49:39.488462Z"}]}}