Input validation error in FFmpeg - CVE-2012-2801

Vulnerability identifier: #VU43573

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2012-2801

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Unspecified vulnerability in libavcodec/avs.c in FFmpeg before 0.11, and Libav 0.7.x before 0.7.7 and 0.8.x before 0.8.4, has unknown impact and attack vectors, related to dimensions and "out of array writes."

FFmpeg
Ubuntu
libavformat52 (Ubuntu package)
libavcodec52 (Ubuntu package)
libavformat53 (Ubuntu package)
libavcodec53 (Ubuntu package)

Install update from vendor's website.

FFmpeg - update to 0.11
libavformat52 (Ubuntu package) - update to 4:0.5.9-0ubuntu0.10.04.2
libavcodec52 (Ubuntu package) - update to 4:0.5.9-0ubuntu0.10.04.2
libavformat53 (Ubuntu package) - addressed in versions 4:0.7.6-0ubuntu0.11.10.2, 4:0.8.4-0ubuntu0.12.04.1, 6:0.8.4-0ubuntu0.12.10.1
libavcodec53 (Ubuntu package) - addressed in versions 4:0.7.6-0ubuntu0.11.10.2, 4:0.8.4-0ubuntu0.12.04.1, 6:0.8.4-0ubuntu0.12.10.1

• http://ffmpeg.org/security.html
• http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=1df49142bab1b7bccd11392aa9e819e297d21a6e
• http://libav.org/releases/libav-0.7.7.changelog
• http://libav.org/releases/libav-0.8.4.changelog
• http://libav.org/releases/libav-0.8.5.changelog
• http://secunia.com/advisories/50468
• http://secunia.com/advisories/51257
• http://www.mandriva.com/security/advisories?name=MDVSA-2013:079
• http://www.openwall.com/lists/oss-security/2012/08/31/3
• http://www.openwall.com/lists/oss-security/2012/09/02/4
• http://www.securityfocus.com/bid/55355
• http://www.ubuntu.com/usn/USN-1705-1

• Input validation error in FFmpeg
• Ubuntu update for ffmpeg
• Ubuntu update for libav
• Ubuntu update for libav