Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
20 results
Aug 11, 2023Buffer Overflow vulnerability in jfif_decode() function in rockcarry ffjpeg through version 1.0.0, allows local attackers to execute arbitrary code due to an isCVE-2020-24222 · Other software · Rockcarry · reported by MITREHigh 7.8
Buffer Overflow vulnerability in jfif_decode() function in rockcarry ffjpeg through version 1.0.0, allows local attackers to execute arbitrary code due to an issue with ALIGN.
- Product
- Ffjpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2022ffjpeg commit caade60a69633d74100bd3c2528bddee0b6a1291 was discovered to contain a memory leak via /src/jfif.c.CVE-2022-35433 · Other software · Ffjpeg Project · reported by MITREMedium 6.5
ffjpeg commit caade60a69633d74100bd3c2528bddee0b6a1291 was discovered to contain a memory leak via /src/jfif.c.
- Product
- Ffjpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2022In ffjpeg (commit hash: caade60), the function bmp_load() in bmp.c contains an integer overflow vulnerability, which eventually results in the heap overflow in CVE-2022-28471 · Other software · Rockcarry · reported by MITREMedium 6.5
In ffjpeg (commit hash: caade60), the function bmp_load() in bmp.c contains an integer overflow vulnerability, which eventually results in the heap overflow in jfif_encode() in jfif.c. This is due to the incomplete patch for issue 38
- Product
- Ffjpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2022The function bitstr_tell at bitstr.c in ffjpeg commit 4ab404e has a NULL pointer dereference.CVE-2021-34122 · Other software · Rockcarry · reported by MITREMedium 5.5
The function bitstr_tell at bitstr.c in ffjpeg commit 4ab404e has a NULL pointer dereference.
- Product
- Ffjpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2022A Null Pointer Dereference vulnerability exits in ffjpeg d5cfd49 (2021-12-06) in bmp_load().CVE-2021-45385 · Other software · Rockcarry · reported by MITREMedium 6.5
A Null Pointer Dereference vulnerability exits in ffjpeg d5cfd49 (2021-12-06) in bmp_load(). When the size information in metadata of the bmp is out of range, it returns without assign memory buffer to `pb->pdata` and did not exit the program. So the program crashes when it tries to access the pb->data, in jfif_encode() at jfif.c:763. This is due to the incomplete patch for CVE-2020-13438.
- Product
- Ffjpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2022Global buffer overflow vulnerability exist in ffjpeg through 01.01.2021.CVE-2021-44957 · Other software · Rockcarry · reported by MITREMedium 6.5
Global buffer overflow vulnerability exist in ffjpeg through 01.01.2021. It is similar to CVE-2020-23705. Issue is in the jfif_encode function at ffjpeg/src/jfif.c (line 708) could cause a Denial of Service by using a crafted jpeg file.
- Product
- Ffjpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2022Two Heap based buffer overflow vulnerabilities exist in ffjpeg through 01.01.2021.CVE-2021-44956 · Other software · Rockcarry · reported by MITREMedium 6.5
Two Heap based buffer overflow vulnerabilities exist in ffjpeg through 01.01.2021. It is similar to CVE-2020-23852. Issues that are in the jfif_decode function at ffjpeg/src/jfif.c (line 552) could cause a Denial of Service by using a crafted jpeg file.
- Product
- Ffjpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2021A global buffer overflow vulnerability in jfif_encode at jfif.c:701 of ffjpeg through 2020-06-22 allows attackers to cause a Denial of Service (DOS) via a craftCVE-2020-23705 · Other software · Rockcarry · reported by MITREMedium 6.5
A global buffer overflow vulnerability in jfif_encode at jfif.c:701 of ffjpeg through 2020-06-22 allows attackers to cause a Denial of Service (DOS) via a crafted jpeg file.
- Product
- Ffjpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2021A heap based buffer overflow vulnerability exists in ffjpeg through 2020-07-02 in the jfif_decode(void *ctxt, BMP *pb) function at ffjpeg/src/jfif.c (line 544 &CVE-2020-23852 · Other software · Rockcarry · reported by MITREMedium 5.5
A heap based buffer overflow vulnerability exists in ffjpeg through 2020-07-02 in the jfif_decode(void *ctxt, BMP *pb) function at ffjpeg/src/jfif.c (line 544 & line 545), which could cause a denial of service by submitting a malicious jpeg image.
- Product
- Ffjpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2021A stack-based buffer overflow vulnerability exists in ffjpeg through 2020-07-02 in the jfif_decode(void *ctxt, BMP *pb) function at ffjpeg/src/jfif.c:513:28, whCVE-2020-23851 · Other software · Rockcarry · reported by MITREMedium 5.5
A stack-based buffer overflow vulnerability exists in ffjpeg through 2020-07-02 in the jfif_decode(void *ctxt, BMP *pb) function at ffjpeg/src/jfif.c:513:28, which could cause a denial of service by submitting a malicious jpeg image.
- Product
- Ffjpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2020ffjpeg through 2020-02-24 has a heap-based buffer overflow in jfif_decode in jfif.c.CVE-2020-15470 · Other software · Rockcarry · reported by MITREMedium 5.5
ffjpeg through 2020-02-24 has a heap-based buffer overflow in jfif_decode in jfif.c.
- Product
- Ffjpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2020ffjpeg through 2020-02-24 has an invalid write in bmp_load in bmp.c.CVE-2020-13440 · Other software · Rockcarry · reported by MITREMedium 6.5
ffjpeg through 2020-02-24 has an invalid write in bmp_load in bmp.c.
- Product
- Ffjpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2020ffjpeg through 2020-02-24 has a heap-based buffer over-read in jfif_decode in jfif.c.CVE-2020-13439 · Other software · Rockcarry · reported by MITREMedium 6.5
ffjpeg through 2020-02-24 has a heap-based buffer over-read in jfif_decode in jfif.c.
- Product
- Ffjpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2020ffjpeg through 2020-02-24 has an invalid read in jfif_encode in jfif.c.CVE-2020-13438 · Other software · Rockcarry · reported by MITREMedium 6.5
ffjpeg through 2020-02-24 has an invalid read in jfif_encode in jfif.c.
- Product
- Ffjpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2019jfif_decode in jfif.c in ffjpeg through 2019-08-21 has a divide-by-zero error.CVE-2019-19888 · Other software · Rockcarry · reported by MITREMedium 6.5
jfif_decode in jfif.c in ffjpeg through 2019-08-21 has a divide-by-zero error.
- Product
- Ffjpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2019bitstr_tell at bitstr.c in ffjpeg through 2019-08-21 has a NULL pointer dereference related to jfif_encode.CVE-2019-19887 · Other software · Rockcarry · reported by MITREMedium 6.5
bitstr_tell at bitstr.c in ffjpeg through 2019-08-21 has a NULL pointer dereference related to jfif_encode.
- Product
- Ffjpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2019ffjpeg before 2019-08-21 has a heap-based buffer overflow in jfif_load() at jfif.c.CVE-2019-16352 · Other software · Rockcarry · reported by MITREMedium 6.5
ffjpeg before 2019-08-21 has a heap-based buffer overflow in jfif_load() at jfif.c.
- Product
- Ffjpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2019ffjpeg before 2019-08-18 has a NULL pointer dereference in huffman_decode_step() at huffman.c.CVE-2019-16351 · Other software · Rockcarry · reported by MITREMedium 6.5
ffjpeg before 2019-08-18 has a NULL pointer dereference in huffman_decode_step() at huffman.c.
- Product
- Ffjpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2019ffjpeg before 2019-08-18 has a NULL pointer dereference in idct2d8x8() at dct.c.CVE-2019-16350 · Other software · Rockcarry · reported by MITREMedium 6.5
ffjpeg before 2019-08-18 has a NULL pointer dereference in idct2d8x8() at dct.c.
- Product
- Ffjpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2018ffjpeg.dll in ffjpeg before 2018-08-22 allows remote attackers to cause a denial of service (FPE signal) via a progressive JPEG file that lacks an AC Huffman taCVE-2018-16781 · Other software · Rockcarry · reported by MITREMedium 6.5
ffjpeg.dll in ffjpeg before 2018-08-22 allows remote attackers to cause a denial of service (FPE signal) via a progressive JPEG file that lacks an AC Huffman table.
- Product
- Ffjpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.