PT-2010-5645 · FFmpeg+1 · Ffmpeg-Dbg+7

Will Dormann · Published 1970-01-01 · Updated 2011-10-26 · CVE-2009-4632

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FFmpeg versions 0.5 and earlier libavdevice52 (affected versions not specified) libavcodec51 (affected versions not specified) libavdevice-dev (affected versions not specified) libavcodec-dev (affected versions not specified) ffmpeg-doc (affected versions not specified) ffmpeg-dbg (affected versions not specified)

Description The issue involves multiple vulnerabilities in the FFmpeg package and related libraries in the Debian GNU/Linux operating system. These vulnerabilities can be exploited remotely, potentially leading to breaches of confidentiality, integrity, and availability of protected information. Specifically, the oggparsevorbis.c file in FFmpeg 0.5 does not properly perform certain pointer arithmetic, which might allow remote attackers to obtain sensitive memory contents and cause a denial of service via a crafted file that triggers an out-of-bounds read.

Recommendations For FFmpeg version 0.5 and earlier, update to a version that fixes the oggparsevorbis.c issue. For libavdevice52, libavcodec51, libavdevice-dev, libavcodec-dev, ffmpeg-doc, and ffmpeg-dbg, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-189

Related Identifiers

BDU:2015-02202

BDU:2015-02203

BDU:2015-02205

BDU:2015-02206

BDU:2015-02207

BDU:2015-02208

CVE-2009-4632

DSA-2000-1

Affected Products

Debian

Ffmpeg

Ffmpeg-Dbg

Ffmpeg-Doc

Libavcodec-Dev

Libavcodec51

Libavdevice-Dev

Libavdevice52

References · 35

• 🔥 http://scarybeastsecurity.blogspot.com/2009/09/patching-ffmpeg-into-shape.html · Exploit
• https://security-tracker.debian.org/tracker/CVE-2009-4632 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2011:112 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4632 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4640 · Security Note
• https://osv.dev/vulnerability/CVE-2009-4632 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-02208 · Security Note
• https://bdu.fstec.ru/vul/2015-02202 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2011:060 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4633 · Security Note
• http://debian.org/security/2010/dsa-2000 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-4632 · Security Note
• https://bdu.fstec.ru/vul/2015-02205 · Security Note
• https://bdu.fstec.ru/vul/2015-02206 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2011:114 · Vendor Advisory