PT-2013-1096 · FFmpeg · Ffmpeg

Published 2013-11-23 · Updated 2016-12-06 · CVE-2013-0858

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 1.0.4

Description The issue allows remote attackers to have an unspecified impact via ATRAC3 data with the joint stereo coding mode set and fewer than two channels. Multiple vulnerabilities in the libav package may lead to disruption of confidentiality, integrity, and availability of protected information, and exploitation can be done remotely.

Recommendations For versions prior to 1.0.4, update to version 1.0.4 or later to resolve the issue. As a temporary workaround, consider disabling the atrac3 decode init function until a patch is available. Restrict access to ATRAC3 data with the joint stereo coding mode set and fewer than two channels to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-189

Related Identifiers

BDU:2015-03049

CVE-2013-0858

DSA-2793-1

Affected Products

Ffmpeg

References · 17

• https://osv.dev/vulnerability/CVE-2013-0858 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-03049 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0844 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0850 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0866 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0857 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2013-0858 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-0858 · Vendor Advisory
• http://debian.org/security/2013/dsa-2793 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0858 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0854 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2013-0858 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0853 · Security Note
• http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=2502914c5f8eb77659d7c0868396862557a63245 · Note
• http://ffmpeg.org/security.html · Note