PT-2012-2912 · FFmpeg · Ffmpeg

Kurt Seifried · Published 2012-08-20 · Updated 2018-10-30 · CVE-2012-0856

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 0.9.1

Description A heap-based buffer overflow issue exists in the MPV frame start function in libavcodec/mpegvideo.c, which can be triggered when the lowres option is enabled. This allows remote attackers to cause a denial of service, resulting in an application crash, via a crafted H263 media file. The issue is a result of a regression error.

Recommendations For versions prior to 0.9.1, update to version 0.9.1 or later to resolve the issue. As a temporary workaround, consider disabling the lowres option to minimize the risk of exploitation.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2012-0856

Affected Products

Ffmpeg

References · 7

• 🔥 http://ffmpeg.org/trac/ffmpeg/ticket/757 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-0856 · Security Note
• http://openwall.com/lists/oss-security/2012/02/01/11 · Note
• http://ffmpeg.org/security.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/78928 · Note
• http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=21270cffaeab2f67a613907516b2b0cd6c9eacf4 · Note
• http://openwall.com/lists/oss-security/2012/02/14/4 · Note