The remote host is affected by the vulnerability described in GLSA-201502-08 (Libav: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Libav. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted media       file in an application linked against Libav, possibly resulting in       execution of arbitrary code with the privileges of the application or a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Multiple vulnerabilities has been discovered and corrected in ffmpeg :

The decode_init function in libavcodec/huffyuv.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via a crafted width in huffyuv data with the predictor set to median and the colorspace set to YUV422P, which triggers an out-of-bounds array access (CVE-2013-0848).

The parse_picture_segment function in libavcodec/pgssubdec.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via crafted RLE data, which triggers an out-of-bounds array access (CVE-2013-0852).

The ff_er_frame_end function in libavcodec/error_resilience.c in FFmpeg before 1.0.4 and 1.1.x before 1.1.1 does not properly verify that a frame is fully initialized, which allows remote attackers to trigger a NULL pointer dereference via crafted picture data (CVE-2013-0860).

The mm_decode_inter function in mmvideo.c in libavcodec in FFmpeg before 1.2.1 does not validate the relationship between a horizontal coordinate and a width value, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted American Laser Games (ALG) MM Video data (CVE-2013-3672).

The cdg_decode_frame function in cdgraphics.c in libavcodec in FFmpeg before 1.2.1 does not validate the presence of non-header data in a buffer, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted CD Graphics Video data (CVE-2013-3674).

The read_header function in libavcodec/ffv1dec.c in FFmpeg before 2.1 does not properly enforce certain bit-count and colorspace constraints, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted FFV1 data (CVE-2013-7020).

The updated packages have been upgraded to the 0.10.15 version which is not vulnerable to these issues.

The remote host is affected by the vulnerability described in GLSA-201310-12 (FFmpeg: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in FFmpeg. Please review       the CVE identifiers and FFmpeg changelogs referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted media       file, possibly leading to the execution of arbitrary code with the       privileges of the user running the application or a Denial of Service.
  Workaround :

    There is no known workaround at this time.

Several security issues have been corrected in multiple demuxers and decoders of the libav multimedia library. A full list of the changes is available at http://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v0.8 .15

ID	Name	Product	Family	Published	Updated	Severity
81231	GLSA-201502-08 : Libav: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2/9/2015	1/11/2021	high
79573	Mandriva Linux Security Advisory : ffmpeg (MDVSA-2014:227)	Nessus	Mandriva Local Security Checks	11/26/2014	1/6/2021	high
70647	GLSA-201310-12 : FFmpeg: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	10/27/2013	1/6/2021	critical
77122	Debian DSA-3003-1 : libav - security update	Nessus	Debian Local Security Checks	8/12/2014	1/11/2021	high

Detections

Analytics

Plugins Search

high

high

critical

high