CVE-2012-0856: Buffer Overflow

Q: What is the severity of CVE-2012-0856?

CVE-2012-0856 has a severity level that may lead to denial of service due to a heap-based buffer overflow.

Q: How do I fix CVE-2012-0856?

To mitigate CVE-2012-0856, it is recommended to upgrade to FFmpeg version 0.9.1 or later.

Q: What causes the vulnerability in CVE-2012-0856?

CVE-2012-0856 is caused by a heap-based buffer overflow in the MPV_frame_start function when the lowres option is enabled.

Q: Which versions of FFmpeg are affected by CVE-2012-0856?

FFmpeg versions prior to 0.9.1, including versions 0.3 through 0.8.11, are affected by CVE-2012-0856.

Q: What type of attack can exploit CVE-2012-0856?

CVE-2012-0856 can be exploited by remote attackers using crafted H263 media files to crash the application.

Published Aug 20, 2012

Updated

Heap-based buffer overflow in the MPVframestart function in libavcodec/mpegvideo.c in FFmpeg before 0.9.1, when the lowres option is enabled, allows remote attackers to cause a denial of service (application crash) via a crafted H263 media file. NOTE: this vulnerability exists because of a regression error.

Affected Software

43 affected components

FFmpeg FFmpeg<=0.9

FFmpeg FFmpeg=0.3

FFmpeg FFmpeg=0.3.1

FFmpeg FFmpeg=0.3.2

FFmpeg FFmpeg=0.3.3

FFmpeg FFmpeg=0.3.4

FFmpeg FFmpeg=0.4.0

FFmpeg FFmpeg=0.4.2

FFmpeg FFmpeg=0.4.3

FFmpeg FFmpeg=0.4.4

FFmpeg FFmpeg=0.4.5

FFmpeg FFmpeg=0.4.6

FFmpeg FFmpeg=0.4.7

FFmpeg FFmpeg=0.4.8

FFmpeg FFmpeg=0.4.9

FFmpeg FFmpeg=0.4.9-pre1

FFmpeg FFmpeg=0.5

FFmpeg FFmpeg=0.5.1

FFmpeg FFmpeg=0.5.2

FFmpeg FFmpeg=0.5.3

FFmpeg FFmpeg=0.5.4

FFmpeg FFmpeg=0.6

FFmpeg FFmpeg=0.6.1

FFmpeg FFmpeg=0.6.2

FFmpeg FFmpeg=0.7

FFmpeg FFmpeg=0.7.1

FFmpeg FFmpeg=0.7.2

FFmpeg FFmpeg=0.7.3

FFmpeg FFmpeg=0.7.6

FFmpeg FFmpeg=0.7.7

FFmpeg FFmpeg=0.7.8

FFmpeg FFmpeg=0.7.9

FFmpeg FFmpeg=0.7.11

FFmpeg FFmpeg=0.7.12

FFmpeg FFmpeg=0.8.0

FFmpeg FFmpeg=0.8.1

FFmpeg FFmpeg=0.8.2

FFmpeg FFmpeg=0.8.5

FFmpeg FFmpeg=0.8.6

FFmpeg FFmpeg=0.8.7

FFmpeg FFmpeg=0.8.8

FFmpeg FFmpeg=0.8.10

FFmpeg FFmpeg=0.8.11

Remediation

Patch Available

http://git.videolan.org/?p=ffmpeg.git;a=commit;h=21270cffaeab2f67a613907516b2b0cd6c9eacf4

Event History

Aug 20, 2012

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2012-0856?

CVE-2012-0856 has a severity level that may lead to denial of service due to a heap-based buffer overflow.

How do I fix CVE-2012-0856?