Off-by-one error in the VP3 decoder (vp3.c) in FFmpeg 0.5 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted VP3 file that triggers an out-of-bounds read and possibly memory corruption.

The remote host is affected by the vulnerability described in GLSA-201310-12 (FFmpeg: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in FFmpeg. Please review       the CVE identifiers and FFmpeg changelogs referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted media       file, possibly leading to the execution of arbitrary code with the       privileges of the user running the application or a Denial of Service.
  Workaround :

    There is no known workaround at this time.

Several vulnerabilities have been discovered in ffmpeg, a multimedia player, server and encoder, which also provides a range of multimedia libraries used in applications like MPlayer :

Various programming errors in container and codec implementations may lead to denial of service or the execution of arbitrary code if the user is tricked into opening a malformed media file or stream.

The implementations of the following affected codecs and container formats have been updated :

  - the Vorbis audio codec
  - the Ogg container implementation

  - the FF Video 1 codec

  - the MPEG audio codec

  - the H264 video codec

  - the MOV container implementation

  - the Oggedc container implementation

ID	Name	Product	Family	Type	Severity
70647	GLSA-201310-12 : FFmpeg: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	critical
44864	Debian DSA-2000-1 : ffmpeg-debian - several vulnerabilities	Nessus	Debian Local Security Checks	Local	critical

Detections

Analytics

CVE-2009-4631

high

Tenable Plugins

critical

critical