Threats tagged 'ghsa-5f73-3r3j-p8mr'

FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder. This vulnerability allows an attacker who can supply a crafted TIFF file with a valid Deflate-compressed strip that decompresses fewer bytes than declared to cause stale heap data to be included in the decoded image output, potentially exposing sensitive data. The vulnerability has a medium severity with a CVSS score of 5.5. A patch is available to address this issue.