{"id":"CVE-2014-8542","aliases":["DEBIAN-CVE-2014-8542","DLA-1654-1","EUVD-2014-8379","GHSA-54rc-7rpj-78x5","MGASA-2014-0464","MGASA-2014-0491","UBUNTU-CVE-2014-8542"],"status":"published","title":"libavcodec/utils.c in FFmpeg before 2.4.2 omits a certain codec ID during enforcement of...","description":"libavcodec/utils.c in FFmpeg before 2.4.2 omits a certain codec ID during enforcement of alignment, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted JV data.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02492,"percentile":0.84751,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2014-11-05T00:00:00Z","modified":"2026-10-23T15:47:36Z","fixes":[{"ecosystem":"Debian:12","package":"ffmpeg","fixed_in":["7:2.4.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ffmpeg","fixed_in":["7:2.4.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ffmpeg","fixed_in":["7:2.4.3-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"libav","fixed_in":["6:9.18-0ubuntu0.14.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:2.4.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:2.4.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:2.4.3-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"libav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6:11.12-1~deb8u5"}]}],"versions":["6:11.11-1~deb8u1","6:11.12-1~deb8u1","6:11.12-1~deb8u2","6:11.12-1~deb8u3","6:11.12-1~deb8u4","6:11.3-1","6:11.3-1+deb8u1","6:11.3-2","6:11.3-3","6:11.4-1","6:11.4-1~deb8u1","6:11.4-2","6:11.4-2+x32.1","6:11.6-1~deb8u1","6:11.7-1~deb8u1","6:11.8-1~deb8u1","6:11.9-1~deb8u1"],"bundled":6},{"source":"osv","ecosystem":"Mageia:4","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.6-1.mga4"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:4","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.6-1.mga4.tainted"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:4","package":"avidemux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.6-2.2.mga4"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:4","package":"avidemux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.6-2.2.mga4.tainted"}]}],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6:9.18-0ubuntu0.14.04.1"}]}],"versions":["6:0.8.7-1ubuntu2","6:9.10-1ubuntu1","6:9.10-1ubuntu2","6:9.10-1ubuntu5","6:9.10-1ubuntu6","6:9.10-1ubuntu7","6:9.11-2ubuntu1","6:9.11-2ubuntu2","6:9.13-0ubuntu0.14.04.1","6:9.14-0ubuntu0.14.04.1","6:9.16-0ubuntu0.14.04.1"]}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"ffmpeg","product":"ffmpeg"}],"references":[{"url":"http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=105654e376a736d243aef4a1d121abebce912e6b","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-2534-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/02/msg00005.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.ffmpeg.org/security.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://security.gentoo.org/glsa/201603-06","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-8542"},{"url":"http://git.videolan.org/?p=ffmpeg.git;a=commit;h=105654e376a736d243aef4a1d121abebce912e6b"},{"url":"https://github.com/advisories/GHSA-54rc-7rpj-78x5"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-8542","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0464.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=14042","tags":["report"]},{"url":"http://git.videolan.org/?p=ffmpeg.git;a=log;h=n2.0.6","tags":["web"]},{"url":"http://ffmpeg.org/olddownload.html","tags":["web"]},{"url":"http://ffmpeg.org/security.html","tags":["web"]},{"url":"http://openwall.com/lists/oss-security/2014/08/16/6","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2014-0491.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=14562","tags":["report"]},{"url":"http://ffmpeg.org/download.html","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2014-8542","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2534-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-8542","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-8542","description":"libavcodec/utils.c in FFmpeg before 2.4.2 omits a certain codec ID during enforcement of alignment, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted JV data.","status":"published","published":"2014-11-05T11:00:00Z","modified":"2024-08-06T13:18:48.518Z","updated_at":"2026-11-02T14:33:43.206348Z"}],"euvd":[{"id":"EUVD-2014-8379","description":"libavcodec/utils.c in FFmpeg before 2.4.2 omits a certain codec ID during enforcement of alignment, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted JV data.","status":"published","published":"2014-11-05T11:00:00Z","modified":"2024-08-06T13:18:48Z","updated_at":"2026-11-03T01:56:51.537817Z"}],"ghsa":[{"id":"GHSA-54rc-7rpj-78x5","title":"libavcodec/utils.c in FFmpeg before 2.4.2 omits a certain codec ID during enforcement of...","description":"libavcodec/utils.c in FFmpeg before 2.4.2 omits a certain codec ID during enforcement of alignment, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted JV data.","status":"published","published":"2022-05-14T01:28:52Z","modified":"2025-04-12T12:42:41Z","cwes":["CWE-119"],"updated_at":"2026-11-02T15:01:19.407948Z"}],"nvd":[{"id":"CVE-2014-8542","description":"libavcodec/utils.c in FFmpeg before 2.4.2 omits a certain codec ID during enforcement of alignment, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted JV data.","status":"published","published":"2014-11-05T11:55:07.887Z","modified":"2026-06-17T00:16:54.31Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:02:57.304171Z"}],"osv":[{"id":"CVE-2014-8542","description":"libavcodec/utils.c in FFmpeg before 2.4.2 omits a certain codec ID during enforcement of alignment, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted JV data.","status":"published","published":"2014-11-05T11:55:07Z","modified":"2026-04-16T06:25:45.464634522Z","updated_at":"2026-11-02T15:44:00.097545Z"},{"id":"DEBIAN-CVE-2014-8542","description":"libavcodec/utils.c in FFmpeg before 2.4.2 omits a certain codec ID during enforcement of alignment, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted JV data.","status":"published","published":"2014-11-05T11:55:07.887Z","modified":"2026-10-23T15:47:36.857395052Z","updated_at":"2026-11-02T15:45:26.442161Z"},{"id":"DLA-1654-1","title":"libav - security update","status":"published","published":"2019-01-31T00:00:00Z","modified":"2026-03-09T01:21:28.928035Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"MGASA-2014-0464","title":"Updated ffmpeg packages fix security vulnerabilities","description":"A heap-based buffer overflow in the encode_slice function in\nlibavcodec/proresenc_kostya.c in FFmpeg before 2.0.6 can cause a crash,\nallowing a malicious image file to cause a denial of service (CVE-2014-5271).\n\nlibavcodec/iff.c in FFmpeg before 2.0.6 allows an attacker to have an\nunspecified impact via a crafted iff image, which triggers an out-of-bounds\narray access, related to the rgb8 and rgbn formats (CVE-2014-5272).\n\nlibavcodec/mjpegdec.c in FFmpeg before 2.0.6 considers only dimension\ndifferences, and not bits-per-pixel differences, when determining whether an\nimage size has changed, which allows remote attackers to cause a denial of\nservice (out-of-bounds access) or possibly have unspecified other impact via\ncrafted MJPEG data (CVE-2014-8541).\n\nlibavcodec/utils.c in FFmpeg before 2.0.6 omits a certain codec ID during\nenforcement of alignment, which allows remote attackers to cause a denial of\nservice (out-of-bounds access) or possibly have unspecified other impact via\ncrafted JV data (CVE-2014-8542).\n\nlibavcodec/mmvideo.c in FFmpeg before 2.0.6 does not consider all lines of\nHHV Intra blocks during validation of image height, which allows remote\nattackers to cause a denial of service (out-of-bounds access) or possibly\nhave unspecified other impact via crafted MM video data (CVE-2014-8543).\n\nlibavcodec/tiff.c in FFmpeg before 2.0.6 does not properly validate\nbits-per-pixel fields, which allows remote attackers to cause a denial of\nservice (out-of-bounds access) or possibly have unspecified other impact via\ncrafted TIFF data (CVE-2014-8544).\n\nlibavcodec/pngdec.c in FFmpeg before 2.0.6 accepts the monochrome-black\nformat without verifying that the bits-per-pixel value is 1, which allows\nremote attackers to cause a denial of service (out-of-bounds access) or\npossibly have unspecified other impact via crafted PNG data (CVE-2014-8545).\n\nInteger underflow in libavcodec/cinepak.c in FFmpeg before 2.0.6 allows\nremote attackers to cause a denial of service (out-of-bounds access) or\npossibly have unspecified other impact via crafted Cinepak video data\n(CVE-2014-8546).\n\nlibavcodec/gifdec.c in FFmpeg before 2.0.6 does not properly compute image\nheights, which allows remote attackers to cause a denial of service\n(out-of-bounds access) or possibly have unspecified other impact via crafted\nGIF data (CVE-2014-8547).\n\nOff-by-one error in libavcodec/smc.c in FFmpeg before 2.0.6 allows remote\nattackers to cause a denial of service (out-of-bounds access) or possibly\nhave unspecified other impact via crafted Quicktime Graphics (aka SMC) video\ndata (CVE-2014-8548).\n","status":"published","published":"2014-11-21T12:44:16Z","modified":"2026-04-16T06:24:24.311355658Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"MGASA-2014-0491","title":"Updated avidemux packages fix security vulnerabilities","description":"A heap-based buffer overflow in the encode_slice function in\nlibavcodec/proresenc_kostya.c in FFmpeg before 1.2.9 can cause a crash,\nallowing a malicious image file to cause a denial of service (CVE-2014-5271).\n\nlibavcodec/iff.c in FFmpeg before 1.2.9 allows an attacker to have an\nunspecified impact via a crafted iff image, which triggers an out-of-bounds\narray access, related to the rgb8 and rgbn formats (CVE-2014-5272).\n\nlibavcodec/mjpegdec.c in FFmpeg before 1.2.9 considers only dimension\ndifferences, and not bits-per-pixel differences, when determining whether an\nimage size has changed, which allows remote attackers to cause a denial of\nservice (out-of-bounds access) or possibly have unspecified other impact via\ncrafted MJPEG data (CVE-2014-8541).\n\nlibavcodec/utils.c in FFmpeg before 1.2.9 omits a certain codec ID during\nenforcement of alignment, which allows remote attackers to cause a denial of\nservice (out-of-bounds access) or possibly have unspecified other impact via\ncrafted JV data (CVE-2014-8542).\n\nlibavcodec/mmvideo.c in FFmpeg before 1.2.9 does not consider all lines of\nHHV Intra blocks during validation of image height, which allows remote\nattackers to cause a denial of service (out-of-bounds access) or possibly\nhave unspecified other impact via crafted MM video data (CVE-2014-8543).\n\nlibavcodec/tiff.c in FFmpeg before 1.2.9 does not properly validate\nbits-per-pixel fields, which allows remote attackers to cause a denial of\nservice (out-of-bounds access) or possibly have unspecified other impact via\ncrafted TIFF data (CVE-2014-8544).\n\nlibavcodec/pngdec.c in FFmpeg before 1.2.9 accepts the monochrome-black\nformat without verifying that the bits-per-pixel value is 1, which allows\nremote attackers to cause a denial of service (out-of-bounds access) or\npossibly have unspecified other impact via crafted PNG data (CVE-2014-8545).\n\nInteger underflow in libavcodec/cinepak.c in FFmpeg before 1.2.9 allows\nremote attackers to cause a denial of service (out-of-bounds access) or\npossibly have unspecified other impact via crafted Cinepak video data\n(CVE-2014-8546).\n\nlibavcodec/gifdec.c in FFmpeg before 1.2.9 does not properly compute image\nheights, which allows remote attackers to cause a denial of service\n(out-of-bounds access) or possibly have unspecified other impact via crafted\nGIF data (CVE-2014-8547).\n\nOff-by-one error in libavcodec/smc.c in FFmpeg before 1.2.9 allows remote\nattackers to cause a denial of service (out-of-bounds access) or possibly\nhave unspecified other impact via crafted Quicktime Graphics (aka SMC) video\ndata (CVE-2014-8548).\n\nAvidemux built with a bundled set of FFmpeg libraries.  The bundled FFmpeg\nversion have been updated from 1.2.7 to 1.2.10 to fix these security issues\nand other bugs fixed upstream in FFmpeg.\n","status":"published","published":"2014-11-26T17:29:06Z","modified":"2026-04-16T06:25:18.637222653Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"UBUNTU-CVE-2014-8542","description":"libavcodec/utils.c in FFmpeg before 2.4.2 omits a certain codec ID during enforcement of alignment, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted JV data.","status":"published","published":"2014-11-05T00:00:00Z","modified":"2026-04-22T09:53:48.514865Z","updated_at":"2026-11-02T15:54:09.378953Z"}]}}