The decode_frame_ilbm function in libavcodec/iff.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via a crafted height value in IFF PBM/ILBM bitmap data.
http://www.ffmpeg.org/security.html
http://www.debian.org/security/2013/dsa-2793
http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=2fbb37b51bbea891392ad357baf8f3dff00bac05