Heap-based buffer overflow in FFmpeg - CVE-2012-0947

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU32787

Heap-based buffer overflow in FFmpeg - CVE-2012-0947

Published: August 20, 2012 / Updated: July 28, 2020


Vulnerability identifier: #VU32787
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2012-0947
CWE-ID: CWE-122
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vendor: ffmpeg.sourceforge.net
Affected software:
FFmpeg

Detailed vulnerability description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in Heap-based buffer overflow in the vqa_decode_chunk function in the VQA codec (vqavideo.c) in libavcodec in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.6, and 0.8.x before 0.8.2. A remote attacker can use a crafted VQA media file in which the image size is not a multiple of the block size. to trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


How to mitigate CVE-2012-0947

The vendor has issued the following versions to address this vulnerability: 0.5.9, 0.6.6, 0.7.6, 0.8.2.

Sources