PT-2013-1094 · Debian+1 · Libav+1

Publicado 2013-11-23 · Atualizado 2014-01-28 · CVE-2013-0854

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libav versions prior to the fixed version

Description The issue concerns multiple vulnerabilities in the libav package of the Debian GNU/Linux operating system, which can be exploited remotely to compromise the confidentiality, integrity, and availability of protected information. Specifically, the mjpeg decode scan progressive ac function in libavcodec/mjpegdec.c in FFmpeg is affected, allowing remote attackers to have an impact via crafted MJPEG data.

Recommendations For versions prior to the fixed version, update to the fixed version to resolve the issue. As a temporary workaround, consider restricting access to the mjpeg decode scan progressive ac function in libavcodec/mjpegdec.c until a patch is available.

Correção

RCE

Enumeração de Fraquezas

CWE-20

CWE-189

Identificadores relacionados

BDU:2015-03049

CVE-2013-0854

DSA-2793-1

Produtos afetados

Ffmpeg

Libav

Referências · 16

• https://bdu.fstec.ru/vul/2015-03049 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0844 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0850 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0866 · Nota de Segurança
• http://ffmpeg.org/security.html · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0857 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2013-0854 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-0854 · Nota de Segurança
• http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=1f41cffe1e3e79620f587545bdfcbd7e6e68ed29 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-0854 · Aviso do Fabricante
• http://debian.org/security/2013/dsa-2793 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2013-0854 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0858 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0854 · Nota de Segurança
• http://debian.org/security/dsa-2793 · Nota