Division by zero in FFmpeg - CVE-2009-4639
Published: October 26, 2011 / Updated: June 8, 2025
Vulnerability identifier: #VU110610
CSH Severity: Medium
CVSS v4: []
CVE-ID: CVE-2009-4639
CWE-ID: CWE-369
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to divide-by-zero error within The av_rescale_rnd function in the AVI demuxer in FFmpeg 0.5. A remote attacker can perform a denial of service (crash) via a crafted AVI file that triggers a divide-by-zero error.
Affected software
FFmpeg
Ubuntu
libavcodec1d (Ubuntu package)
libavformat1d (Ubuntu package)
libavformat52 (Ubuntu package)
libavcodec51 (Ubuntu package)
libavcodec52 (Ubuntu package)
Ubuntu
libavcodec1d (Ubuntu package)
libavformat1d (Ubuntu package)
libavformat52 (Ubuntu package)
libavcodec51 (Ubuntu package)
libavcodec52 (Ubuntu package)
How to mitigate CVE-2009-4639
Install update from vendor's website.
libavcodec1d (Ubuntu package) - update to 3:0.cvs20070307-5ubuntu7.4
libavformat1d (Ubuntu package) - update to 3:0.cvs20070307-5ubuntu7.4
libavformat52 (Ubuntu package) - addressed in versions 3:0.svn20080206-12ubuntu3.2, 3:0.svn20090303-1ubuntu6.1, 4:0.5+svn20090706-2ubuntu2.1
libavcodec51 (Ubuntu package) - update to 3:0.svn20080206-12ubuntu3.2
libavcodec52 (Ubuntu package) - addressed in versions 3:0.svn20090303-1ubuntu6.1, 4:0.5+svn20090706-2ubuntu2.1
libavformat1d (Ubuntu package) - update to 3:0.cvs20070307-5ubuntu7.4
libavformat52 (Ubuntu package) - addressed in versions 3:0.svn20080206-12ubuntu3.2, 3:0.svn20090303-1ubuntu6.1, 4:0.5+svn20090706-2ubuntu2.1
libavcodec51 (Ubuntu package) - update to 3:0.svn20080206-12ubuntu3.2
libavcodec52 (Ubuntu package) - addressed in versions 3:0.svn20090303-1ubuntu6.1, 4:0.5+svn20090706-2ubuntu2.1
External References
- http://scarybeastsecurity.blogspot.com/2009/09/patching-ffmpeg-into-shape.html
- http://secunia.com/advisories/36805
- http://secunia.com/advisories/39482
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:059
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:060
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:061
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:088
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:112
- http://www.securityfocus.com/bid/36465
- http://www.ubuntu.com/usn/USN-931-1
- http://www.vupen.com/english/advisories/2010/0935
- http://www.vupen.com/english/advisories/2011/1241
- https://roundup.ffmpeg.org/roundup/ffmpeg/issue1240
- https://roundup.ffmpeg.org/roundup/ffmpeg/issue1245