Division by zero in FFmpeg - CVE-2013-0894
Published: June 8, 2025
Vulnerability identifier: #VU110557
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2013-0894
CWE-ID: CWE-369
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to divide-by-zero error n the vorbis_parse_setup_hdr_floors function in the Vorbis decoder in vorbisdec.c. A remote attacker can crash the application.
Affected software
FFmpeg
How to mitigate CVE-2013-0894
Install update from vendor's website.
FFmpeg - update to 1.1.4
External References
- http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html
- http://git.chromium.org/gitweb/?p=chromium/deps/ffmpeg.git;a=commit;h=e1e70d9bb9852b7d099379afc95531a632a20ba5
- https://code.google.com/p/chromium/issues/detail?id=168473
- http://git.videolan.org/?p=ffmpeg.git;a=commit;h=2c16bf2de07c68513072bf3cc96401d2c6291a3e
- http://lists.opensuse.org/opensuse-updates/2013-03/msg00045.html
- http://www.ubuntu.com/usn/USN-1790-1