Integer overflow in FFmpeg 0.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors.

The remote host is affected by the vulnerability described in GLSA-201310-12 (FFmpeg: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in FFmpeg. Please review       the CVE identifiers and FFmpeg changelogs referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted media       file, possibly leading to the execution of arbitrary code with the       privileges of the user running the application or a Denial of Service.
  Workaround :

    There is no known workaround at this time.

It was discovered that FFmpeg contained multiple security issues when handling certain multimedia files. If a user were tricked into opening a crafted multimedia file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in ffmpeg, a multimedia player, server and encoder, which also provides a range of multimedia libraries used in applications like MPlayer :

Various programming errors in container and codec implementations may lead to denial of service or the execution of arbitrary code if the user is tricked into opening a malformed media file or stream.

The implementations of the following affected codecs and container formats have been updated :

  - the Vorbis audio codec
  - the Ogg container implementation

  - the FF Video 1 codec

  - the MPEG audio codec

  - the H264 video codec

  - the MOV container implementation

  - the Oggedc container implementation

ID	Name	Product	Family	Severity
70647	GLSA-201310-12 : FFmpeg: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
45575	Ubuntu 8.04 LTS / 8.10 / 9.04 / 9.10 : ffmpeg, ffmpeg-debian vulnerabilities (USN-931-1)	Nessus	Ubuntu Local Security Checks	critical
44864	Debian DSA-2000-1 : ffmpeg-debian - several vulnerabilities	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2009-4638

critical

Tenable Plugins

critical

critical

critical