SB2012091104 - Multiple vulnerabilities in ffmpeg.sourceforge.net FFmpeg

Main Vulnerability Database SB2012091104

SB2012091104 - Multiple vulnerabilities in ffmpeg.sourceforge.net FFmpeg

Published: September 11, 2012 Updated: August 11, 2020

Security Bulletin ID SB2012091104

Severity

High

Patch available

YES

Number of vulnerabilities 6

Exploitation vector Remote access

Highest impact Code execution

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 6 secuirty vulnerabilities.

1) Input validation error (CVE-ID: CVE-2012-2799)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Unspecified vulnerability in libavcodec/wmalosslessdec.c in FFmpeg before 0.11 has unknown impact and attack vectors, related to the "put bit buffer when num_saved_bits is reset."

2) Buffer overflow (CVE-ID: CVE-2012-2774)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The ff_MPV_frame_start function in libavcodec/mpegvideo.c in FFmpeg before 0.11 allows remote attackers to cause a denial of service (memory corruption) via unspecified vectors, related to starting "a frame outside SETUP state."

3) Input validation error (CVE-ID: CVE-2012-2782)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Unspecified vulnerability in the decode_slice_header function in libavcodec/h264.c in FFmpeg before 0.11 has unknown impact and attack vectors, related to a "rejected resolution change."

4) Input validation error (CVE-ID: CVE-2012-2785)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Multiple unspecified vulnerabilities in libavcodec/wmalosslessdec.c in FFmpeg before 0.11 have unknown impact and attack vectors, related to (1) "some subframes only encode some channels" or (2) a large order value.

5) Input validation error (CVE-ID: CVE-2012-2792)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Unspecified vulnerability in the decode_init function in libavcodec/wmalosslessdec.c in FFmpeg before 0.11 has unknown impact and attack vectors, related to the samples per frame.

6) Input validation error (CVE-ID: CVE-2012-2795)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Multiple unspecified vulnerabilities in libavcodec/wmalosslessdec.c in FFmpeg before 0.11 have unknown impact and attack vectors related to (1) size of "mclms arrays," (2) "a get_bits(0) in decode_ac_filter," and (3) "too many bits in decode_channel_residues()."

Remediation

Install update from vendor's website.

References