PT-2013-1096 · FFmpeg · Ffmpeg

Publicado

2013-11-23

·

Atualizado

2016-12-06

·

CVE-2013-0858

CVSS v2.0

9.3

Alta

VetorAV:N/AC:M/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 1.0.4
Description The issue allows remote attackers to have an unspecified impact via ATRAC3 data with the joint stereo coding mode set and fewer than two channels. Multiple vulnerabilities in the libav package may lead to disruption of confidentiality, integrity, and availability of protected information, and exploitation can be done remotely.
Recommendations For versions prior to 1.0.4, update to version 1.0.4 or later to resolve the issue. As a temporary workaround, consider disabling the atrac3 decode init function until a patch is available. Restrict access to ATRAC3 data with the joint stereo coding mode set and fewer than two channels to minimize the risk of exploitation.

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

BDU:2015-03049
CVE-2013-0858
DSA-2793-1

Produtos afetados

Ffmpeg