The ff_er_frame_end function in libavcodec/error_resilience.c in FFmpeg before 1.0.4 and 1.1.x before 1.1.1 does not properly verify that a frame is fully initialized, which allows remote attackers to trigger a NULL pointer dereference via crafted picture data.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - qffmpeg: Invalid free in libavcodec/shorten.c due to invalid channel count (CVE-2013-0873)

  - qffmpeg: out of array write in case of realloc failure in libavcodec/parser.c (CVE-2013-7023)

  - The ff_er_frame_end function in libavcodec/error_resilience.c in FFmpeg before 1.0.4 and 1.1.x before     1.1.1 does not properly verify that a frame is fully initialized, which allows remote attackers to trigger     a NULL pointer dereference via crafted picture data. (CVE-2013-0860)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote host is affected by the vulnerability described in GLSA-201603-06 (FFmpeg: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in FFmpeg.  Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code or cause a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The remote host is affected by the vulnerability described in GLSA-201502-08 (Libav: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Libav. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted media       file in an application linked against Libav, possibly resulting in       execution of arbitrary code with the privileges of the application or a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Multiple vulnerabilities has been discovered and corrected in ffmpeg :

The decode_init function in libavcodec/huffyuv.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via a crafted width in huffyuv data with the predictor set to median and the colorspace set to YUV422P, which triggers an out-of-bounds array access (CVE-2013-0848).

The parse_picture_segment function in libavcodec/pgssubdec.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via crafted RLE data, which triggers an out-of-bounds array access (CVE-2013-0852).

The ff_er_frame_end function in libavcodec/error_resilience.c in FFmpeg before 1.0.4 and 1.1.x before 1.1.1 does not properly verify that a frame is fully initialized, which allows remote attackers to trigger a NULL pointer dereference via crafted picture data (CVE-2013-0860).

The mm_decode_inter function in mmvideo.c in libavcodec in FFmpeg before 1.2.1 does not validate the relationship between a horizontal coordinate and a width value, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted American Laser Games (ALG) MM Video data (CVE-2013-3672).

The cdg_decode_frame function in cdgraphics.c in libavcodec in FFmpeg before 1.2.1 does not validate the presence of non-header data in a buffer, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted CD Graphics Video data (CVE-2013-3674).

The read_header function in libavcodec/ffv1dec.c in FFmpeg before 2.1 does not properly enforce certain bit-count and colorspace constraints, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted FFV1 data (CVE-2013-7020).

The updated packages have been upgraded to the 0.10.15 version which is not vulnerable to these issues.

Several security issues have been corrected in multiple demuxers and decoders of the libav multimedia library. A full list of the changes is available at http://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v0.8 .15

ID	Name	Product	Family	Severity
198687	RHEL 5 : qffmpeg (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
89899	GLSA-201603-06 : FFmpeg: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
81231	GLSA-201502-08 : Libav: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
79573	Mandriva Linux Security Advisory : ffmpeg (MDVSA-2014:227)	Nessus	Mandriva Local Security Checks	high
77122	Debian DSA-3003-1 : libav - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2013-0860

medium

Tenable Plugins

high

critical

high

high

high