Buffer overflow in FFmpeg - CVE-2013-0868

Vulnerability identifier: #VU42325

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2013-0868

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

libavcodec/huffyuvdec.c in FFmpeg before 1.1.2 allows remote attackers to have an unspecified impact via crafted Huffyuv data, related to an out-of-bounds write and (1) unchecked return codes from the init_vlc function and (2) "len==0 cases."

FFmpeg
Gentoo Linux
openEuler
media-video/ffmpeg
ffmpeg
ffmpeg-debuginfo
ffmpeg-debugsource
libavdevice
ffmpeg-devel
ffmpeg-libs
media-video/libav

Install update from vendor's website.

media-video/ffmpeg - update to 2.6.3
ffmpeg - update to 4.2.4-4
ffmpeg-debuginfo - update to 4.2.4-4
ffmpeg-debugsource - update to 4.2.4-4
libavdevice - update to 4.2.4-4
ffmpeg-devel - update to 4.2.4-4
ffmpeg-libs - update to 4.2.4-4
media-video/libav - update to 9.17

• http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=6baa54924980e1f0e8121e4715d16ed1adcd2a23
• http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=75e88db33013eaa7ab74457f5556df677b4ffb42
• http://www.ffmpeg.org/security.html
• https://security.gentoo.org/glsa/201603-06

• Multiple vulnerabilities in ffmpeg.sourceforge.net FFmpeg
• openEuler update for ffmpeg
• Gentoo update for Libav
• Gentoo update for FFmpeg