PT-2013-2658 · FFmpeg · Ffmpeg

Published 2013-12-07 · Updated 2013-12-27 · CVE-2013-0859

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 1.1

Description The issue is related to the add doubles metadata function in libavcodec/tiff.c, which can be exploited by remote attackers via a negative or zero count value in a TIFF image. This triggers an out-of-bounds array access, potentially leading to an unspecified impact.

Recommendations For versions prior to 1.1, update to version 1.1 or later to resolve the issue. As a temporary workaround, consider restricting the processing of TIFF images with negative or zero count values until a patch is applied.

Exploit

Fix

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2013-0859

Affected Products

Ffmpeg

References · 4

• 🔥 http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=6d1c5ea04af3e345232aa70c944de961061dab2d · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-0859 · Security Note
• http://ffmpeg.org/security.html · Note
• http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=6d1c5ea04af3e345232aa70c944de961061dab2d · Note