PT-2010-1004 · Debian+1 · Debian+1

Greg Maxwell · Published 2010-09-30 · Updated 2011-10-26 · CVE-2010-4704

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FFmpeg versions 0.6.1 and earlier

Description The issue is related to the Vorbis decoder in FFmpeg, where a crafted .ogg file can cause a denial of service, leading to an application crash. This is due to a problem in the vorbis floor0 decode function. Additionally, there are multiple vulnerabilities in the ffmpeg-debian package in Debian GNU/Linux that can lead to breaches of confidentiality, integrity, and availability of protected information, and these can be exploited remotely.

Recommendations For FFmpeg versions 0.6.1 and earlier, consider updating to a newer version to resolve the issue. As a temporary workaround, consider avoiding the use of the Vorbis decoder until a patch is available. Restrict access to crafted .ogg files to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

CWE-189

Related Identifiers

BDU:2015-01322

CVE-2010-4704

DSA-2165-1

DSA-2306-1

Affected Products

Debian

Ffmpeg

References · 25

• 🔥 https://roundup.ffmpeg.org/issue2322 · Exploit
• http://mandriva.com/security/advisories?name=MDVSA-2011:112 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-01322 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2010-4704 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2011:114 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2011:062 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3429 · Security Note
• http://ubuntu.com/usn/usn-1104-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-4704 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2011:089 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-4704 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2011:060 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2010-4704 · Vendor Advisory
• http://debian.org/security/2011/dsa-2165 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4705 · Security Note