PT-2010-5644 · FFmpeg+1 · Ffmpeg-Dbg+7

Will Dormann · Publicado 1970-01-01 · Atualizado 2010-05-04 · CVE-2009-4631

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ffmpeg-dbg (affected versions not specified) libavdevice52 (affected versions not specified) libavcodec51 (affected versions not specified) libavdevice-dev (affected versions not specified) libavcodec-dev (affected versions not specified) ffmpeg-doc (affected versions not specified) FFmpeg versions prior to 0.5

Description The issue concerns multiple vulnerabilities in various packages of the Debian GNU/Linux operating system, including ffmpeg-dbg, libavdevice52, libavcodec51, libavdevice-dev, libavcodec-dev, and ffmpeg-doc. These vulnerabilities can lead to disruptions in confidentiality, integrity, and availability of protected information. Exploitation of these vulnerabilities can be carried out remotely. Additionally, there is an off-by-one error in the VP3 decoder of FFmpeg 0.5, which allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted VP3 file.

Recommendations For ffmpeg-dbg, consider updating to a version that includes the fix for this issue. For libavdevice52, consider updating to a version that includes the fix for this issue. For libavcodec51, consider updating to a version that includes the fix for this issue. For libavdevice-dev, consider updating to a version that includes the fix for this issue. For libavcodec-dev, consider updating to a version that includes the fix for this issue. For ffmpeg-doc, consider updating to a version that includes the fix for this issue. For FFmpeg, update to a version later than 0.5 to resolve the off-by-one error in the VP3 decoder. At the moment, there is no information about a newer version that contains a fix for the other vulnerabilities.

Exploit

Correção

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

BDU:2015-02202

BDU:2015-02203

BDU:2015-02205

BDU:2015-02206

BDU:2015-02207

BDU:2015-02208

CVE-2009-4631

DSA-2000-1

Produtos afetados

Debian

Ffmpeg

Ffmpeg-Dbg

Ffmpeg-Doc

Libavcodec-Dev

Libavcodec51

Libavdevice-Dev

Libavdevice52

Referências · 27

• 🔥 http://scarybeastsecurity.blogspot.com/2009/09/patching-ffmpeg-into-shape.html · Exploit
• https://roundup.ffmpeg.org/roundup/ffmpeg/issue1483 · Nota
• https://osv.dev/vulnerability/CVE-2009-4631 · Aviso do Fabricante
• http://secunia.com/advisories/38643 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-4631 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4632 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-02205 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-02206 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4640 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4637 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-02208 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4636 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-02203 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4638 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-02202 · Nota de Segurança