CVE-2012-0859: Buffer Overflow
First published: Mon Aug 20 2012(Updated: )
The render_line function in the vorbis codec (vorbis.c) in libavcodec in FFmpeg before 0.9.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted Vorbis file, related to a large multiplier. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3893.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| FFmpeg | <=0.9 | |
| FFmpeg | =0.7.1 | |
| FFmpeg | =0.7.2 | |
| FFmpeg | =0.7.7 | |
| FFmpeg | =0.7.8 | |
| FFmpeg | =0.7.9 | |
| FFmpeg | =0.7.11 | |
| FFmpeg | =0.7.12 | |
| FFmpeg | =0.8.5 | |
| FFmpeg | =0.8.6 | |
| FFmpeg | =0.8.7 | |
| FFmpeg | =0.8.8 | |
| FFmpeg | =0.8.10 | |
| FFmpeg | =0.8.11 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://ffmpeg.org/security.html
- http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=6fcf2bb8af0e7d6bb179e71e67e5fab8ef0d2ec2
- http://www.openwall.com/lists/oss-security/2012/02/14/4
- http://www.ubuntu.com/usn/USN-1479-1
- https://exchange.xforce.ibmcloud.com/vulnerabilities/78925
- http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=6fcf2bb8af0e7d6bb179e71e67e5fab8ef0d2ec2
Frequently Asked Questions
What is the severity of CVE-2012-0859?
CVE-2012-0859 has a high severity level due to its potential for denial of service and arbitrary code execution.
How do I fix CVE-2012-0859?
To fix CVE-2012-0859, upgrade to FFmpeg version 0.9.1 or later.
What causes CVE-2012-0859?
CVE-2012-0859 is caused by the render_line function in the vorbis codec improperly handling crafted Vorbis files.
What versions of FFmpeg are affected by CVE-2012-0859?
CVE-2012-0859 affects all FFmpeg versions prior to 0.9.1 and specific older versions like 0.7.1, 0.7.2, 0.7.7, 0.7.8, 0.7.9, 0.7.11, 0.7.12, and multiple from the 0.8 series.
Is it safe to use older versions of FFmpeg with CVE-2012-0859?
Using older versions of FFmpeg affected by CVE-2012-0859 is unsafe as they could lead to application crashes and security risks.
- agent/type
- agent/remedy
- agent/weakness
- agent/severity
- agent/author
- agent/softwarecombine
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/ffmpeg
- canonical/ffmpeg
- version/ffmpeg/0.9
- version/ffmpeg/0.7.1
- version/ffmpeg/0.7.2
- version/ffmpeg/0.7.7
- version/ffmpeg/0.7.8
- version/ffmpeg/0.7.9
- version/ffmpeg/0.7.11
- version/ffmpeg/0.7.12
- version/ffmpeg/0.8.5
- version/ffmpeg/0.8.6
- version/ffmpeg/0.8.7
- version/ffmpeg/0.8.8
- version/ffmpeg/0.8.10
- version/ffmpeg/0.8.11