CVE-2012-0849: Integer Overflow

Q: What is the severity of CVE-2012-0849?

The severity of CVE-2012-0849 is considered medium due to its potential to cause a denial of service through application crashes.

Q: How do I fix CVE-2012-0849?

To fix CVE-2012-0849, upgrade to FFmpeg version 0.9.1 or later.

Q: What causes CVE-2012-0849?

CVE-2012-0849 is caused by an integer overflow in the ff_j2k_dwt_init function when processing crafted JPEG2000 images.

Q: Which versions of FFmpeg are affected by CVE-2012-0849?

All FFmpeg versions prior to 0.9.1, including versions 0.3 through 0.8.11, are affected by CVE-2012-0849.

Q: Can CVE-2012-0849 be exploited remotely?

Yes, CVE-2012-0849 can be exploited remotely by attackers using specially crafted JPEG2000 images to trigger a crash.

Published Aug 27, 2012

Updated

Integer overflow in the ffj2kdwtinit function in libavcodec/j2kdwt.c in FFmpeg before 0.9.1 allows remote attackers to cause a denial of service (segmentation fault and application crash) via a crafted JPEG2000 image that triggers an incorrect check for a negative value.

Affected Software

43 affected components

FFmpeg FFmpeg<=0.9

FFmpeg FFmpeg=0.3

FFmpeg FFmpeg=0.3.1

FFmpeg FFmpeg=0.3.2

FFmpeg FFmpeg=0.3.3

FFmpeg FFmpeg=0.3.4

FFmpeg FFmpeg=0.4.0

FFmpeg FFmpeg=0.4.2

FFmpeg FFmpeg=0.4.3

FFmpeg FFmpeg=0.4.4

FFmpeg FFmpeg=0.4.5

FFmpeg FFmpeg=0.4.6

FFmpeg FFmpeg=0.4.7

FFmpeg FFmpeg=0.4.8

FFmpeg FFmpeg=0.4.9

FFmpeg FFmpeg=0.4.9-pre1

FFmpeg FFmpeg=0.5

FFmpeg FFmpeg=0.5.1

FFmpeg FFmpeg=0.5.2

FFmpeg FFmpeg=0.5.3

FFmpeg FFmpeg=0.5.4

FFmpeg FFmpeg=0.6

FFmpeg FFmpeg=0.6.1

FFmpeg FFmpeg=0.6.2

FFmpeg FFmpeg=0.7

FFmpeg FFmpeg=0.7.1

FFmpeg FFmpeg=0.7.2

FFmpeg FFmpeg=0.7.3

FFmpeg FFmpeg=0.7.6

FFmpeg FFmpeg=0.7.7

FFmpeg FFmpeg=0.7.8

FFmpeg FFmpeg=0.7.9

FFmpeg FFmpeg=0.7.11

FFmpeg FFmpeg=0.7.12

FFmpeg FFmpeg=0.8.0

FFmpeg FFmpeg=0.8.1

FFmpeg FFmpeg=0.8.2

FFmpeg FFmpeg=0.8.5

FFmpeg FFmpeg=0.8.6

FFmpeg FFmpeg=0.8.7

FFmpeg FFmpeg=0.8.8

FFmpeg FFmpeg=0.8.10

FFmpeg FFmpeg=0.8.11

Remediation

Patch Available

http://www.ffmpeg.org/trac/ffmpeg/ticket/776

Event History

Aug 27, 2012

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2012-0849?

The severity of CVE-2012-0849 is considered medium due to its potential to cause a denial of service through application crashes.

How do I fix CVE-2012-0849?