Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

FFmpeg in Chrome can crash when playing crafted audio

CVE-2014-7937 · published 11 years ago
Summary

Older versions of the FFmpeg library used by Google Chrome may mishandle specially crafted Vorbis audio files, causing the browser to stop responding. This happens because the software miscounts data, leading to a memory error that can crash the program. Updating Chrome to a version released after the fix or applying the FFmpeg update will resolve the issue.

What to do
  • Update debian ffmpeg to version 7:2.4.2-1.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian ffmpeg < 7:2.4.2-1
Fix: upgrade to 7:2.4.2-1
Debian:13 debian ffmpeg < 7:2.4.2-1
Fix: upgrade to 7:2.4.2-1
Debian:14 debian ffmpeg < 7:2.4.2-1
Fix: upgrade to 7:2.4.2-1
– ffmpeg ffmpeg <= 2.4.1
cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*
– google chrome <= 40.0.2214.85
cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Original advisory text
Multiple off-by-one errors in libavcodec/vorbisdec.c in FFmpeg before 2.4.2, as used in Google Chrome before 40.0.2214.91, allow remote attackers to cause a denial of service (use-after-free) or po...
Multiple off-by-one errors in libavcodec/vorbisdec.c in FFmpeg before 2.4.2, as used in Google Chrome before 40.0.2214.91, allow remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted Vorbis I data.
References
Severity
7.5 High
Exploitation
2% chance of attack within 30 days
Type
CWE-119Buffer Overflow
Timeline
Published22 Jan 2015
Updated3 Nov 2026
First seen1 Sep 2026
Sources
DEBIAN-CVE-2014-7937 · OSV
CVE-2014-7937 · NVD
Track software like this
Free during beta