Multiple buffer overflows in libavcodec in ffmpeg before 0.4.9_p20060530 allow remote attackers to cause a denial of service or possibly execute arbitrary code via multiple unspecified vectors in (1) dtsdec.c, (2) vorbis.c, (3) rm.c, (4) sierravmd.c, (5) smacker.c, (6) tta.c, (7) 4xm.c, (8) alac.c, (9) cook.c, (10) shorten.c, (11) smacker.c, (12) snow.c, and (13) tta.c. NOTE: it is likely that this is a different vulnerability than CVE-2005-4048 and CVE-2006-2802.

Multiple buffer overflows were fixed in the XINE decoder libraries, which could be used by attackers to crash players or potentially execute code.

  - Buffer overflow in ffmpeg for xine-lib before 1.1.2     might allow context-dependent attackers to execute     arbitrary code via a crafted AVI file and 'bad indexes'.
    (CVE-2006-4799)

  - Multiple buffer overflows in libavcodec in ffmpeg before     0.4.9_p20060530 allow remote attackers to cause a denial     of service or possibly execute arbitrary code via     multiple unspecified vectors in (1) dtsdec.c, (2)     vorbis.c, (3) rm.c, (4) sierravmd.c, (5) smacker.c, (6)     tta.c, (7) 4xm.c, (8) alac.c, (9) cook.c, (10)     shorten.c, (11) smacker.c, (12) snow.c, and (13) tta.c.
    (CVE-2006-4800)

XFOCUS Security Team discovered that the AVI decoder used in xine-lib did not correctly validate certain headers. By tricking a user into playing an AVI with malicious headers, an attacker could execute arbitrary code with the target user's privileges. (CVE-2006-4799)

Multiple integer overflows were discovered in ffmpeg and tools that contain a copy of ffmpeg (like xine-lib and kino), for several types of video formats. By tricking a user into running a video player that uses ffmpeg on a stream with malicious content, an attacker could execute arbitrary code with the target user's privileges.
(CVE-2006-4800).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple buffer overflows were fixed in the XINE decoder libraries, which could be used by attackers to crash players or potentially execute code.

CVE-2006-4799: Buffer overflow in ffmpeg for xine-lib before 1.1.2 might allow context-dependent attackers to execute arbitrary code via a crafted AVI file and 'bad indexes'.

CVE-2006-4800: Multiple buffer overflows in libavcodec in ffmpeg before 0.4.9_p20060530 allow remote attackers to cause a denial of service or possibly execute arbitrary code via multiple unspecified vectors in (1) dtsdec.c, (2) vorbis.c, (3) rm.c, (4) sierravmd.c, (5) smacker.c, (6) tta.c, (7) 4xm.c, (8) alac.c, (9) cook.c, (10) shorten.c, (11) smacker.c, (12) snow.c, and (13) tta.c.

Xine-lib uses an embedded copy of ffmpeg and as such has been updated to address the following issue: Multiple buffer overflows in libavcodec in ffmpeg before 0.4.9_p20060530 allow remote attackers to cause a denial of service or possibly execute arbitrary code via multiple unspecified vectors in (1) dtsdec.c, (2) vorbis.c, (3) rm.c, (4)sierravmd.c, (5) smacker.c, (6) tta.c, (7) 4xm.c, (8) alac.c, (9) cook.c, (10)shorten.c, (11) smacker.c, (12) snow.c, and (13) tta.c.
NOTE: it is likely that this is a different vulnerability than CVE-2005-4048 and CVE-2006-2802.

Updated packages have been patched to correct this issue.

Mplayer uses an embedded copy of ffmpeg and as such has been updated to address the following issue: Multiple buffer overflows in libavcodec in ffmpeg before 0.4.9_p20060530 allow remote attackers to cause a denial of service or possibly execute arbitrary code via multiple unspecified vectors in (1) dtsdec.c, (2) vorbis.c, (3) rm.c, (4)sierravmd.c, (5) smacker.c, (6) tta.c, (7) 4xm.c, (8) alac.c, (9) cook.c, (10)shorten.c, (11) smacker.c, (12) snow.c, and (13) tta.c.
NOTE: it is likely that this is a different vulnerability than CVE-2005-4048 and CVE-2006-2802.

Updated packages have been patched to correct this issue.

Gstreamer-ffmpeg uses an embedded copy of ffmpeg and as such has been updated to address the following issue: Multiple buffer overflows in libavcodec in ffmpeg before 0.4.9_p20060530 allow remote attackers to cause a denial of service or possibly execute arbitrary code via multiple unspecified vectors in (1) dtsdec.c, (2) vorbis.c, (3) rm.c, (4)sierravmd.c, (5) smacker.c, (6) tta.c, (7) 4xm.c, (8) alac.c, (9) cook.c, (10)shorten.c, (11) smacker.c, (12) snow.c, and (13) tta.c.
NOTE: it is likely that this is a different vulnerability than CVE-2005-4048 and CVE-2006-2802.

Updated packages have been patched to correct this issue.

Multiple buffer overflows in libavcodec in ffmpeg before 0.4.9_p20060530 allow remote attackers to cause a denial of service or possibly execute arbitrary code via multiple unspecified vectors in (1) dtsdec.c, (2) vorbis.c, (3) rm.c, (4)sierravmd.c, (5) smacker.c, (6) tta.c, (7) 4xm.c, (8) alac.c, (9) cook.c, (10)shorten.c, (11) smacker.c, (12) snow.c, and (13) tta.c. NOTE: it is likely that this is a different vulnerability than CVE-2005-4048 and CVE-2006-2802.

Updated packages have been patched to correct this issue.

Several remote vulnerabilities have been discovered in the Xine multimedia library, which may lead to the execution of arbitrary code.
The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2006-4799     The XFocus Security Team discovered that insufficient     validation of AVI headers may lead to the execution of     arbitrary code.

  - CVE-2006-4800     Michael Niedermayer discovered that a buffer overflow in     the 4XM codec may lead to the execution of arbitrary     code.

The remote host is affected by the vulnerability described in GLSA-200609-09 (FFmpeg: Buffer overflows)

    FFmpeg contains buffer overflows in the AVI processing code.
  Impact :

    An attacker could trigger the buffer overflows by enticing a user to     load a specially crafted AVI file in an application using the FFmpeg     library. This might result in the execution of arbitrary code in the     context of the running application.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
29598	SuSE 10 Security Update : xine-lib (ZYPP Patch Number 2307)	Nessus	SuSE Local Security Checks	high
27938	Ubuntu 5.04 / 5.10 / 6.06 LTS : ffmpeg, xine-lib vulnerabilities (USN-358-1)	Nessus	Ubuntu Local Security Checks	high
27485	openSUSE 10 Security Update : xine-lib (xine-lib-2308)	Nessus	SuSE Local Security Checks	high
24562	Mandrake Linux Security Advisory : xine-lib (MDKSA-2006:176)	Nessus	Mandriva Local Security Checks	high
24561	Mandrake Linux Security Advisory : mplayer (MDKSA-2006:175)	Nessus	Mandriva Local Security Checks	high
24560	Mandrake Linux Security Advisory : gstreamer-ffmpeg (MDKSA-2006:174)	Nessus	Mandriva Local Security Checks	high
24559	Mandrake Linux Security Advisory : ffmpeg (MDKSA-2006:173)	Nessus	Mandriva Local Security Checks	high
23701	Debian DSA-1215-1 : xine-lib - several vulnerabilities	Nessus	Debian Local Security Checks	high
22354	GLSA-200609-09 : FFmpeg: Buffer overflows	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2006-4800

critical

Tenable Plugins

high

high

high

high

high

high

high

high

high