Buffer overflow in FFmpeg - CVE-2013-2496
Published: March 9, 2013 / Updated: August 11, 2020
Vulnerability identifier: #VU43014
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2013-2496
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
The msrle_decode_8_16_24_32 function in msrledec.c in libavcodec in FFmpeg through 1.1.3 does not properly determine certain end pointers, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via crafted Microsoft RLE data.
Affected software
FFmpeg
Ubuntu
libavcodec53 (Ubuntu package)
libavformat53 (Ubuntu package)
Ubuntu
libavcodec53 (Ubuntu package)
libavformat53 (Ubuntu package)
How to mitigate CVE-2013-2496
Install update from vendor's website.
libavcodec53 (Ubuntu package) - addressed in versions 4:0.8.6-0ubuntu0.12.04.1, 6:0.8.6-0ubuntu0.12.10.1
libavformat53 (Ubuntu package) - addressed in versions 4:0.8.6-0ubuntu0.12.04.1, 6:0.8.6-0ubuntu0.12.10.1
libavformat53 (Ubuntu package) - addressed in versions 4:0.8.6-0ubuntu0.12.04.1, 6:0.8.6-0ubuntu0.12.10.1