Resource management error in Libav and FFmpeg - CVE-2012-0858

Vulnerability identifier: #VU43705

CSH Severity: Medium

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2012-0858

CWE-ID: CWE-399

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The Shorten codec (shorten.c) in libavcodec in FFmpeg 0.7.x before 0.7.12 and 0.8.x before 0.8.11, and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.5, and 0.8.x before 0.8.1, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted Shorten file, related to an "invalid free".

Libav
FFmpeg
Gentoo Linux
Ubuntu
libavcodec52 (Ubuntu package)
libavformat52 (Ubuntu package)
libavcodec53 (Ubuntu package)
libavformat53 (Ubuntu package)

Install update from vendor's website.

libavcodec52 (Ubuntu package) - addressed in versions 4:0.5.9-0ubuntu0.10.04.1, 4:0.6.6-0ubuntu0.11.04.1
libavformat52 (Ubuntu package) - addressed in versions 4:0.5.9-0ubuntu0.10.04.1, 4:0.6.6-0ubuntu0.11.04.1
libavcodec53 (Ubuntu package) - addressed in versions 4:0.7.6-0ubuntu0.11.10.1, 4:0.8.3-0ubuntu0.12.04.1
libavformat53 (Ubuntu package) - addressed in versions 4:0.7.6-0ubuntu0.11.10.1, 4:0.8.3-0ubuntu0.12.04.1

• http://ffmpeg.org/
• http://git.libav.org/?p=libav.git;a=commitdiff;h=204cb29b3c84a74cbcd059d353c70c8bdc567d98
• http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=204cb29b3c84a74cbcd059d353c70c8bdc567d98
• http://libav.org/
• http://www.openwall.com/lists/oss-security/2012/02/14/4
• http://www.ubuntu.com/usn/USN-1479-1

• Gentoo update for Libav
• Ubuntu update for ffmpeg
• Ubuntu update for libav