PT-2013-1094 · Debian+1 · Libav+1

Published 2013-11-23 · Updated 2014-01-28 · CVE-2013-0854

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libav versions prior to the fixed version

Description The issue concerns multiple vulnerabilities in the libav package of the Debian GNU/Linux operating system, which can be exploited remotely to compromise the confidentiality, integrity, and availability of protected information. Specifically, the mjpeg decode scan progressive ac function in libavcodec/mjpegdec.c in FFmpeg is affected, allowing remote attackers to have an impact via crafted MJPEG data.

Recommendations For versions prior to the fixed version, update to the fixed version to resolve the issue. As a temporary workaround, consider restricting access to the mjpeg decode scan progressive ac function in libavcodec/mjpegdec.c until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

CWE-189

Related Identifiers

BDU:2015-03049

CVE-2013-0854

DSA-2793-1

Affected Products

Ffmpeg

Libav

References · 16

• https://bdu.fstec.ru/vul/2015-03049 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0844 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0850 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0866 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0857 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2013-0854 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-0854 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-0854 · Vendor Advisory
• http://debian.org/security/2013/dsa-2793 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-0854 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0858 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0854 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0853 · Security Note
• http://ffmpeg.org/security.html · Note
• http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=1f41cffe1e3e79620f587545bdfcbd7e6e68ed29 · Note