PT-2010-1450 · FFmpeg · Ffmpeg

Will Dormann · Published 2010-02-10 · Updated 2011-10-26 · CVE-2009-4639

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions FFmpeg version 0.5

Description The issue allows remote attackers to cause a denial of service, resulting in a crash, by providing a crafted AVI file. This file triggers a divide-by-zero error in the av rescale rnd function within the AVI demuxer.

Recommendations For FFmpeg version 0.5, consider updating to a newer version to mitigate the risk, as the current version contains a function that can be exploited to cause a denial of service. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2009-4639

Affected Products

Ffmpeg

References · 18

• 🔥 http://scarybeastsecurity.blogspot.com/2009/09/patching-ffmpeg-into-shape.html · Exploit
• http://mandriva.com/security/advisories?name=MDVSA-2011:112 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-4639 · Security Note
• https://osv.dev/vulnerability/CVE-2009-4639 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-4639 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2009-4639 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2011:060 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2011:059 · Vendor Advisory
• http://ubuntu.com/usn/USN-931-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2011:061 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2011:088 · Vendor Advisory
• https://roundup.ffmpeg.org/roundup/ffmpeg/issue1245 · Note
• http://vupen.com/english/advisories/2011/1241 · Note
• http://secunia.com/advisories/39482 · Note
• http://securityfocus.com/bid/36465 · Note