#VU110557 Division by zero in FFmpeg - CVE-2013-0894
Published: June 8, 2025
Vulnerability identifier: #VU110557
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2013-0894
CWE-ID: CWE-369
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
FFmpeg
FFmpeg
Software vendor:
ffmpeg.sourceforge.net
ffmpeg.sourceforge.net
Description
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to divide-by-zero error n the vorbis_parse_setup_hdr_floors function in the Vorbis decoder in vorbisdec.c. A remote attacker can crash the application.
Remediation
Install update from vendor's website.
External links
- http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html
- http://git.chromium.org/gitweb/?p=chromium/deps/ffmpeg.git;a=commit;h=e1e70d9bb9852b7d099379afc95531a632a20ba5
- https://code.google.com/p/chromium/issues/detail?id=168473
- http://git.videolan.org/?p=ffmpeg.git;a=commit;h=2c16bf2de07c68513072bf3cc96401d2c6291a3e
- http://lists.opensuse.org/opensuse-updates/2013-03/msg00045.html
- http://www.ubuntu.com/usn/USN-1790-1