CVE-2009-4635: Code Injection

Published Feb 10, 2010

Updated

FFmpeg 0.5 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted MOV container with improperly ordered tags that cause (1) mov.c and (2) utils.c to use inconsistent codec types and identifiers, leading to processing of a video-structure pointer by the mp3 decoder, and a stack-based buffer overflow.

Affected Software

1 affected component

FFmpeg FFmpeg=0.5

Event History

Feb 10, 2010

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Data Sourced

via NVD·02:30 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2009-4635?

CVE-2009-4635 is considered a high severity vulnerability due to its potential to cause denial of service and execute arbitrary code.

How do I fix CVE-2009-4635?

To fix CVE-2009-4635, upgrade to a patched version of FFmpeg that addresses this vulnerability.

What software is affected by CVE-2009-4635?

CVE-2009-4635 specifically affects FFmpeg version 0.5.

What type of attack does CVE-2009-4635 involve?

CVE-2009-4635 involves a remote attacker exploiting crafted MOV containers to manipulate codec types, potentially leading to arbitrary code execution.

Can CVE-2009-4635 lead to system compromise?

Yes, the exploitation of CVE-2009-4635 can potentially allow an attacker to execute arbitrary code on the affected system.