CVE-2012-0859: Buffer Overflow

Q: What is the severity of CVE-2012-0859?

CVE-2012-0859 has a high severity level due to its potential for denial of service and arbitrary code execution.

Q: How do I fix CVE-2012-0859?

To fix CVE-2012-0859, upgrade to FFmpeg version 0.9.1 or later.

Q: What causes CVE-2012-0859?

CVE-2012-0859 is caused by the render_line function in the vorbis codec improperly handling crafted Vorbis files.

Q: What versions of FFmpeg are affected by CVE-2012-0859?

CVE-2012-0859 affects all FFmpeg versions prior to 0.9.1 and specific older versions like 0.7.1, 0.7.2, 0.7.7, 0.7.8, 0.7.9, 0.7.11, 0.7.12, and multiple from the 0.8 series.

Q: Is it safe to use older versions of FFmpeg with CVE-2012-0859?

Using older versions of FFmpeg affected by CVE-2012-0859 is unsafe as they could lead to application crashes and security risks.

Published Aug 20, 2012

Updated

The renderline function in the vorbis codec (vorbis.c) in libavcodec in FFmpeg before 0.9.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted Vorbis file, related to a large multiplier. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3893.

Affected Software

14 affected components

FFmpeg FFmpeg<=0.9

FFmpeg FFmpeg=0.7.1

FFmpeg FFmpeg=0.7.2

FFmpeg FFmpeg=0.7.7

FFmpeg FFmpeg=0.7.8

FFmpeg FFmpeg=0.7.9

FFmpeg FFmpeg=0.7.11

FFmpeg FFmpeg=0.7.12

FFmpeg FFmpeg=0.8.5

FFmpeg FFmpeg=0.8.6

FFmpeg FFmpeg=0.8.7

FFmpeg FFmpeg=0.8.8

FFmpeg FFmpeg=0.8.10

FFmpeg FFmpeg=0.8.11

Remediation

Patch Available

http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=6fcf2bb8af0e7d6bb179e71e67e5fab8ef0d2ec2

Event History

Aug 20, 2012

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2012-0859?

CVE-2012-0859 has a high severity level due to its potential for denial of service and arbitrary code execution.

How do I fix CVE-2012-0859?