PT-2010-1003 · FFmpeg+1 · Libavcodec+2

Published 2010-09-30 · Updated 2018-10-10 · CVE-2010-3429

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FFmpeg versions 0.6 and earlier

Description The issue concerns multiple vulnerabilities in the ffmpeg-debian package of the Debian GNU/Linux operating system, which can be exploited remotely to compromise the confidentiality, integrity, and availability of protected information. Specifically, a vulnerability in the flicvideo.c file of libavcodec in FFmpeg allows remote attackers to execute arbitrary code via a crafted flic file, related to an arbitrary offset dereference vulnerability.

Recommendations For FFmpeg versions 0.6 and earlier, consider updating to a newer version to mitigate the risk of exploitation. As a temporary workaround, consider restricting access to flic files or disabling the flicvideo.c component until a patch is available. Avoid using the vulnerable libavcodec version in applications that handle flic files.

Fix

Code Injection

Weakness Enumeration

CWE-94

CWE-189

Related Identifiers

BDU:2015-01322

CVE-2010-3429

DSA-2165-1

Affected Products

Debian

Ffmpeg

Libavcodec

References · 28

• https://osv.dev/vulnerability/CVE-2010-3429 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2011:112 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-01322 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2011:114 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2010-3429 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2011:062 · Vendor Advisory
• http://vupen.com/english/advisories/2010/2518 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3429 · Security Note
• http://ubuntu.com/usn/usn-1104-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2011:089 · Vendor Advisory
• http://vupen.com/english/advisories/2010/2517 · Vendor Advisory
• http://secunia.com/advisories/41626 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2011:060 · Vendor Advisory
• http://debian.org/security/2011/dsa-2165 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-3429 · Vendor Advisory