PT-2010-5645 · FFmpeg+1 · Ffmpeg-Dbg+7

Will Dormann · Publicado 1970-01-01 · Atualizado 2011-10-26 · CVE-2009-4632

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FFmpeg versions 0.5 and earlier libavdevice52 (affected versions not specified) libavcodec51 (affected versions not specified) libavdevice-dev (affected versions not specified) libavcodec-dev (affected versions not specified) ffmpeg-doc (affected versions not specified) ffmpeg-dbg (affected versions not specified)

Description The issue involves multiple vulnerabilities in the FFmpeg package and related libraries in the Debian GNU/Linux operating system. These vulnerabilities can be exploited remotely, potentially leading to breaches of confidentiality, integrity, and availability of protected information. Specifically, the oggparsevorbis.c file in FFmpeg 0.5 does not properly perform certain pointer arithmetic, which might allow remote attackers to obtain sensitive memory contents and cause a denial of service via a crafted file that triggers an out-of-bounds read.

Recommendations For FFmpeg version 0.5 and earlier, update to a version that fixes the oggparsevorbis.c issue. For libavdevice52, libavcodec51, libavdevice-dev, libavcodec-dev, ffmpeg-doc, and ffmpeg-dbg, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

BDU:2015-02202

BDU:2015-02203

BDU:2015-02205

BDU:2015-02206

BDU:2015-02207

BDU:2015-02208

CVE-2009-4632

DSA-2000-1

Produtos afetados

Debian

Ffmpeg

Ffmpeg-Dbg

Ffmpeg-Doc

Libavcodec-Dev

Libavcodec51

Libavdevice-Dev

Libavdevice52

Referências · 35

• 🔥 http://scarybeastsecurity.blogspot.com/2009/09/patching-ffmpeg-into-shape.html · Exploit
• https://security-tracker.debian.org/tracker/CVE-2009-4632 · Aviso do Fabricante
• http://secunia.com/advisories/38643 · Nota
• http://mandriva.com/security/advisories?name=MDVSA-2011:112 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4632 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4640 · Nota de Segurança
• http://vupen.com/english/advisories/2011/1241 · Nota
• https://osv.dev/vulnerability/CVE-2009-4632 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2015-02208 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-02202 · Nota de Segurança
• http://mandriva.com/security/advisories?name=MDVSA-2011:060 · Aviso do Fabricante
• http://debian.org/security/dsa-2000 · Nota
• http://securityfocus.com/bid/36465 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4633 · Nota de Segurança
• http://debian.org/security/2010/dsa-2000 · Aviso do Fabricante