PT-2010-1003 · FFmpeg+1 · Libavcodec+2

Publicado 2010-09-30 · Atualizado 2018-10-10 · CVE-2010-3429

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FFmpeg versions 0.6 and earlier

Description The issue concerns multiple vulnerabilities in the ffmpeg-debian package of the Debian GNU/Linux operating system, which can be exploited remotely to compromise the confidentiality, integrity, and availability of protected information. Specifically, a vulnerability in the flicvideo.c file of libavcodec in FFmpeg allows remote attackers to execute arbitrary code via a crafted flic file, related to an arbitrary offset dereference vulnerability.

Recommendations For FFmpeg versions 0.6 and earlier, consider updating to a newer version to mitigate the risk of exploitation. As a temporary workaround, consider restricting access to flic files or disabling the flicvideo.c component until a patch is available. Avoid using the vulnerable libavcodec version in applications that handle flic files.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

CWE-189

Identificadores relacionados

BDU:2015-01322

CVE-2010-3429

DSA-2165-1

Produtos afetados

Debian

Ffmpeg

Libavcodec

Referências · 28

• https://osv.dev/vulnerability/CVE-2010-3429 · Aviso do Fabricante
• http://mandriva.com/security/advisories?name=MDVSA-2011:112 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2015-01322 · Nota de Segurança
• http://git.ffmpeg.org/?p=ffmpeg%3Ba=commit%3Bh=16c592155f117ccd7b86006c45aacc692a81c23b · Nota
• http://mandriva.com/security/advisories?name=MDVSA-2011:114 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2010-3429 · Aviso do Fabricante
• http://mandriva.com/security/advisories?name=MDVSA-2011:062 · Aviso do Fabricante
• http://vupen.com/english/advisories/2011/1241 · Nota
• http://vupen.com/english/advisories/2010/2518 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3429 · Nota de Segurança
• http://securityfocus.com/archive/1/514009/100/0/threaded · Nota
• http://ubuntu.com/usn/usn-1104-1 · Aviso do Fabricante
• http://ocert.org/advisories/ocert-2010-004.html · Nota
• http://mandriva.com/security/advisories?name=MDVSA-2011:089 · Aviso do Fabricante
• http://vupen.com/english/advisories/2010/2517 · Aviso do Fabricante