Skip to main content

FFmpeg Multiple Vulnerabilities

Last Update Date: 2 Oct 2013 09:57 Release Date: 2 Oct 2013 3203 Views

RISK: Medium Risk

TYPE: Clients - Audio & Video

TYPE: Audio & Video

Multiple vulnerabilities have been identified in FFmpeg, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise an application using the library.

  1. An error within the "pcx_decode_frame()" function (libavcodec/pcx.c) can be exploited to cause a crash.
  2. An error within the "xan_decode_init()" function (libavcodec/xxan.c) can be exploited to cause an out of bounds write memory access.
  3. An error within the "pcx_decode_frame()" function (libavcodec/pcx.c) can be exploited to trigger an infinite loop.
  4. An error within the "png_decode_idat()" function (libavcodec/pngdec.c) can be exploited to trigger an infinite loop.
  5. An error within the "bfi_read_packet()" function (libavformat/bfi.c) can be exploited to trigger a division-by-zero exception.
  6. An error within the "ff_get_wav_header()" function (libavformat/riffdec.c) can be exploited to trigger a division-by-zero exception.
  7. An error within the "read_header()" function (libavformat/mvi.c) can be exploited to trigger a division-by-zero exception.
  8. A boundary error within the "decode_element()" function (libavcodec/alac.c) can be exploited to cause an out of bounds write memory access.
  9. An error within the "xwma_read_header()" function (libavformat/xwma.c) can be exploited to trigger a division-by-zero exception.
  10. An error within the "read_gab2_sub()" function (libavformat/avidec.c) can be exploited to cause an out of bounds read memory access.
  11. An error within the "vqf_read_header()" function (libavformat/vqf.c) can be exploited to cause a crash.

Successful exploitation of the vulnerabilities #2 and #8 may allow execution of arbitrary code.


Impact

  • Denial of Service
  • Remote Code Execution

System / Technologies affected

  • FFmpeg 2.x

Solutions

Before installation of the software, please visit the software manufacturer web-site for more details.

  • Fixed in the git repository.

Vulnerability Identifier

  • No CVE information is available

Source


Related Link