CVE-2012-0850: Buffer Overflow

Q: What is the severity of CVE-2012-0850?

CVE-2012-0850 has a severity rating that indicates a denial of service vulnerability which can cause application crashes.

Q: How do I fix CVE-2012-0850?

To fix CVE-2012-0850, upgrade to FFmpeg version 0.9.1 or later.

Q: What systems are affected by CVE-2012-0850?

CVE-2012-0850 affects multiple versions of FFmpeg prior to 0.9.1, including all versions from 0.3 to 0.8.11.

Q: What is the impact of exploiting CVE-2012-0850?

Exploiting CVE-2012-0850 can lead to memory corruption which may result in application crashes and denial of service.

Q: Is there a workaround for CVE-2012-0850?

There are no known effective workarounds for CVE-2012-0850, so it is recommended to upgrade to a patched version.

Published Aug 20, 2012

Updated

The sbrqmfsynthesis function in libavcodec/aacsbr.c in FFmpeg before 0.9.1 allows remote attackers to cause a denial of service (application crash) via a crafted mpg file that triggers memory corruption involving the voff variable, probably a buffer underflow.

Affected Software

43 affected components

FFmpeg FFmpeg<=0.9

FFmpeg FFmpeg=0.3

FFmpeg FFmpeg=0.3.1

FFmpeg FFmpeg=0.3.2

FFmpeg FFmpeg=0.3.3

FFmpeg FFmpeg=0.3.4

FFmpeg FFmpeg=0.4.0

FFmpeg FFmpeg=0.4.2

FFmpeg FFmpeg=0.4.3

FFmpeg FFmpeg=0.4.4

FFmpeg FFmpeg=0.4.5

FFmpeg FFmpeg=0.4.6

FFmpeg FFmpeg=0.4.7

FFmpeg FFmpeg=0.4.8

FFmpeg FFmpeg=0.4.9

FFmpeg FFmpeg=0.4.9-pre1

FFmpeg FFmpeg=0.5

FFmpeg FFmpeg=0.5.1

FFmpeg FFmpeg=0.5.2

FFmpeg FFmpeg=0.5.3

FFmpeg FFmpeg=0.5.4

FFmpeg FFmpeg=0.6

FFmpeg FFmpeg=0.6.1

FFmpeg FFmpeg=0.6.2

FFmpeg FFmpeg=0.7

FFmpeg FFmpeg=0.7.1

FFmpeg FFmpeg=0.7.2

FFmpeg FFmpeg=0.7.3

FFmpeg FFmpeg=0.7.6

FFmpeg FFmpeg=0.7.7

FFmpeg FFmpeg=0.7.8

FFmpeg FFmpeg=0.7.9

FFmpeg FFmpeg=0.7.11

FFmpeg FFmpeg=0.7.12

FFmpeg FFmpeg=0.8.0

FFmpeg FFmpeg=0.8.1

FFmpeg FFmpeg=0.8.2

FFmpeg FFmpeg=0.8.5

FFmpeg FFmpeg=0.8.6

FFmpeg FFmpeg=0.8.7

FFmpeg FFmpeg=0.8.8

FFmpeg FFmpeg=0.8.10

FFmpeg FFmpeg=0.8.11

Remediation

Patch Available

http://git.videolan.org/?p=ffmpeg.git;a=commit;h=944f5b2779e4aa63f7624df6cd4de832a53db81b

Event History

Aug 20, 2012

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2012-0850?

CVE-2012-0850 has a severity rating that indicates a denial of service vulnerability which can cause application crashes.

How do I fix CVE-2012-0850?