GLSA-201310-12 : FFmpeg: Multiple vulnerabilities

critical Nessus Plugin ID 70647

Language:

Synopsis

The remote Gentoo host is missing one or more security-related patches.

Description

The remote host is affected by the vulnerability described in GLSA-201310-12 (FFmpeg: Multiple vulnerabilities)

Multiple vulnerabilities have been discovered in FFmpeg. Please review the CVE identifiers and FFmpeg changelogs referenced below for details.
Impact :

A remote attacker could entice a user to open a specially crafted media file, possibly leading to the execution of arbitrary code with the privileges of the user running the application or a Denial of Service.
Workaround :

There is no known workaround at this time.

Solution

All FFmpeg users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose '>=media-video/ffmpeg-1.0.7'

Plugin Details

Severity: Critical

ID: 70647

File Name: gentoo_GLSA-201310-12.nasl

Version: 1.14

Type: local

Family: Gentoo Local Security Checks

Published: 10/27/2013

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:gentoo:linux:ffmpeg, cpe:/o:gentoo:linux

Required KB Items: Host/local_checks_enabled, Host/Gentoo/release, Host/Gentoo/qpkg-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/25/2013

Reference Information

CVE: CVE-2009-4631, CVE-2009-4632, CVE-2009-4633, CVE-2009-4634, CVE-2009-4635, CVE-2009-4636, CVE-2009-4637, CVE-2009-4638, CVE-2009-4639, CVE-2009-4640, CVE-2010-3429, CVE-2010-3908, CVE-2010-4704, CVE-2010-4705, CVE-2011-1931, CVE-2011-3362, CVE-2011-3893, CVE-2011-3895, CVE-2011-3929, CVE-2011-3934, CVE-2011-3935, CVE-2011-3936, CVE-2011-3937, CVE-2011-3940, CVE-2011-3941, CVE-2011-3944, CVE-2011-3945, CVE-2011-3946, CVE-2011-3947, CVE-2011-3949, CVE-2011-3950, CVE-2011-3951, CVE-2011-3952, CVE-2011-3973, CVE-2011-3974, CVE-2011-4351, CVE-2011-4352, CVE-2011-4353, CVE-2011-4364, CVE-2012-0947, CVE-2012-2771, CVE-2012-2772, CVE-2012-2773, CVE-2012-2774, CVE-2012-2775, CVE-2012-2776, CVE-2012-2777, CVE-2012-2778, CVE-2012-2779, CVE-2012-2780, CVE-2012-2781, CVE-2012-2782, CVE-2012-2783, CVE-2012-2784, CVE-2012-2785, CVE-2012-2786, CVE-2012-2787, CVE-2012-2788, CVE-2012-2789, CVE-2012-2790, CVE-2012-2791, CVE-2012-2792, CVE-2012-2793, CVE-2012-2794, CVE-2012-2795, CVE-2012-2796, CVE-2012-2797, CVE-2012-2798, CVE-2012-2799, CVE-2012-2800, CVE-2012-2801, CVE-2012-2802, CVE-2012-2803, CVE-2012-2804, CVE-2012-2805, CVE-2013-3670, CVE-2013-3671, CVE-2013-3672, CVE-2013-3673, CVE-2013-3674, CVE-2013-3675

BID: 36465, 46294, 47147, 47602, 49115, 49118, 50642, 50760, 50880, 51720, 53389, 55355, 60476, 60491, 60492, 60494, 60496, 60497

CWE: 119, 189, 94

GLSA: 201310-12

Detections

Analytics