CVE-2012-0853

The decodeTonalComponents function in the Actrac3 codec (atrac3.c) in libavcodec in FFmpeg 0.7.x before 0.7.12, and 0.8.x before 0.8.11; and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.5, and 0.8.x before 0.8.1 allows remote attackers to cause a denial of service (infinite loop and crash) and possibly execute arbitrary code via a large component count in an Atrac 3 file.

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://ffmpeg.org/trac/ffmpeg/ticket/780	Exploit
http://git.libav.org/?p=libav.git%3Ba=commit%3Bh=c509f4f74713b035a06f79cb4d00e708f5226bc5
http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=9af6abdc17deb95c9b1f1d9242ba49b8b5e0b016
http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=c509f4f74713b035a06f79cb4d00e708f5226bc5
http://secunia.com/advisories/49089
http://www.openwall.com/lists/oss-security/2012/02/14/4
http://www.ubuntu.com/usn/USN-1479-1
http://ffmpeg.org/trac/ffmpeg/ticket/780	Exploit
http://git.libav.org/?p=libav.git%3Ba=commit%3Bh=c509f4f74713b035a06f79cb4d00e708f5226bc5
http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=9af6abdc17deb95c9b1f1d9242ba49b8b5e0b016
http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=c509f4f74713b035a06f79cb4d00e708f5226bc5
http://secunia.com/advisories/49089
http://www.openwall.com/lists/oss-security/2012/02/14/4
http://www.ubuntu.com/usn/USN-1479-1

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ffmpeg:ffmpeg:0.7:::::::*
	cpe:2.3:a:ffmpeg:ffmpeg:0.7.1:::::::*
	cpe:2.3:a:ffmpeg:ffmpeg:0.7.2:::::::*
	cpe:2.3:a:ffmpeg:ffmpeg:0.7.3:::::::*
	cpe:2.3:a:ffmpeg:ffmpeg:0.7.6:::::::*
	cpe:2.3:a:ffmpeg:ffmpeg:0.7.7:::::::*
	cpe:2.3:a:ffmpeg:ffmpeg:0.7.8:::::::*
	cpe:2.3:a:ffmpeg:ffmpeg:0.7.9:::::::*
	cpe:2.3:a:ffmpeg:ffmpeg:0.7.11:::::::*
	cpe:2.3:a:ffmpeg:ffmpeg:0.8.0:::::::*
	cpe:2.3:a:ffmpeg:ffmpeg:0.8.1:::::::*
	cpe:2.3:a:ffmpeg:ffmpeg:0.8.2:::::::*
	cpe:2.3:a:ffmpeg:ffmpeg:0.8.5:::::::*
	cpe:2.3:a:ffmpeg:ffmpeg:0.8.6:::::::*
	cpe:2.3:a:ffmpeg:ffmpeg:0.8.7:::::::*
	cpe:2.3:a:ffmpeg:ffmpeg:0.8.8:::::::*
	cpe:2.3:a:ffmpeg:ffmpeg:0.8.10:::::::*

Configuration 2 (hide)

OR	cpe:2.3:a:libav:libav:0.5:::::::*
	cpe:2.3:a:libav:libav:0.5.1:::::::*
	cpe:2.3:a:libav:libav:0.5.2:::::::*
	cpe:2.3:a:libav:libav:0.5.3:::::::*
	cpe:2.3:a:libav:libav:0.5.4:::::::*
	cpe:2.3:a:libav:libav:0.5.5:::::::*
	cpe:2.3:a:libav:libav:0.5.6:::::::*
	cpe:2.3:a:libav:libav:0.5.7:::::::*
	cpe:2.3:a:libav:libav:0.6:::::::*
	cpe:2.3:a:libav:libav:0.6.1:::::::*
	cpe:2.3:a:libav:libav:0.6.2:::::::*
	cpe:2.3:a:libav:libav:0.6.3:::::::*
	cpe:2.3:a:libav:libav:0.6.4:::::::*
	cpe:2.3:a:libav:libav:0.6.5:::::::*
	cpe:2.3:a:libav:libav:0.7:::::::*
	cpe:2.3:a:libav:libav:0.7:beta1::::::
	cpe:2.3:a:libav:libav:0.7:beta2::::::
	cpe:2.3:a:libav:libav:0.7.1:::::::*
	cpe:2.3:a:libav:libav:0.7.2:::::::*
	cpe:2.3:a:libav:libav:0.7.3:::::::*
	cpe:2.3:a:libav:libav:0.7.4:::::::*
	cpe:2.3:a:libav:libav:0.8:::::::*
	cpe:2.3:a:libav:libav:0.8:beta2::::::

History

21 Nov 2024, 01:35

Type	Values Removed	Values Added
References	~~() http://ffmpeg.org/trac/ffmpeg/ticket/780 - Exploit~~	() http://ffmpeg.org/trac/ffmpeg/ticket/780 - Exploit
References	~~() http://git.libav.org/?p=libav.git%3Ba=commit%3Bh=c509f4f74713b035a06f79cb4d00e708f5226bc5 -~~	() http://git.libav.org/?p=libav.git%3Ba=commit%3Bh=c509f4f74713b035a06f79cb4d00e708f5226bc5 -
References	~~() http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=9af6abdc17deb95c9b1f1d9242ba49b8b5e0b016 -~~	() http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=9af6abdc17deb95c9b1f1d9242ba49b8b5e0b016 -
References	~~() http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=c509f4f74713b035a06f79cb4d00e708f5226bc5 -~~	() http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=c509f4f74713b035a06f79cb4d00e708f5226bc5 -
References	~~() http://secunia.com/advisories/49089 -~~	() http://secunia.com/advisories/49089 -
References	~~() http://www.openwall.com/lists/oss-security/2012/02/14/4 -~~	() http://www.openwall.com/lists/oss-security/2012/02/14/4 -
References	~~() http://www.ubuntu.com/usn/USN-1479-1 -~~	() http://www.ubuntu.com/usn/USN-1479-1 -

07 Nov 2023, 02:10

Type	Values Removed	Values Added
References	{'url': 'http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=c509f4f74713b035a06f79cb4d00e708f5226bc5', 'name': 'http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=c509f4f74713b035a06f79cb4d00e708f5226bc5', 'tags': ['Patch'], 'refsource': 'CONFIRM'} {'url': 'http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=9af6abdc17deb95c9b1f1d9242ba49b8b5e0b016', 'name': 'http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=9af6abdc17deb95c9b1f1d9242ba49b8b5e0b016', 'tags': ['Patch'], 'refsource': 'CONFIRM'} {'url': 'http://git.libav.org/?p=libav.git;a=commit;h=c509f4f74713b035a06f79cb4d00e708f5226bc5', 'name': 'http://git.libav.org/?p=libav.git;a=commit;h=c509f4f74713b035a06f79cb4d00e708f5226bc5', 'tags': ['Patch'], 'refsource': 'CONFIRM'}	() http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=9af6abdc17deb95c9b1f1d9242ba49b8b5e0b016 - () http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=c509f4f74713b035a06f79cb4d00e708f5226bc5 - () http://git.libav.org/?p=libav.git%3Ba=commit%3Bh=c509f4f74713b035a06f79cb4d00e708f5226bc5 -

Information

Published : 2012-08-20 18:55

Updated : 2024-11-21 01:35

NVD link : CVE-2012-0853

Mitre link : CVE-2012-0853

CVE.ORG link : CVE-2012-0853

JSON object : View

Products Affected

libav

libav

ffmpeg

ffmpeg

CWE

CWE-20

Improper Input Validation

6.8 /10