CVE-2012-2772: Critical severity Libav Libav vulnerability

Q: What is the severity of CVE-2012-2772?

The severity of CVE-2012-2772 is currently unknown due to unspecified impact and attack vectors.

Q: How do I fix CVE-2012-2772?

To fix CVE-2012-2772, upgrade to FFmpeg version 0.11 or later, or Libav version 0.7.7 or later.

Q: Which versions of software are affected by CVE-2012-2772?

CVE-2012-2772 affects FFmpeg versions before 0.11 and Libav versions 0.7.x before 0.7.7 and 0.8.x before 0.8.4.

Q: What is the cause of CVE-2012-2772?

CVE-2012-2772 is caused by an issue in the ff_rv34_decode_frame function related to "width/height changing with frame threading."

Q: Can I still use affected versions of FFmpeg and Libav safely with CVE-2012-2772?

It is not recommended to use affected versions of FFmpeg and Libav as they may expose your system to vulnerabilities.

Published Sep 10, 2012

Updated

Unspecified vulnerability in the ffrv34decodeframe function in libavcodec/rv34.c in FFmpeg before 0.11, and Libav 0.7.x before 0.7.7 and 0.8.x before 0.8.4, has unknown impact and attack vectors, related to "width/height changing with frame threading."

Affected Software

68 affected components

Libav Libav=0.8

Libav Libav=0.8-beta2

Libav Libav=0.8.1

Libav Libav=0.8.2

Libav Libav=0.8.3

FFmpeg FFmpeg<=0.10.4

FFmpeg FFmpeg=0.3

FFmpeg FFmpeg=0.3.1

FFmpeg FFmpeg=0.3.2

FFmpeg FFmpeg=0.3.3

FFmpeg FFmpeg=0.3.4

FFmpeg FFmpeg=0.4.0

FFmpeg FFmpeg=0.4.2

FFmpeg FFmpeg=0.4.3

FFmpeg FFmpeg=0.4.4

FFmpeg FFmpeg=0.4.5

FFmpeg FFmpeg=0.4.6

FFmpeg FFmpeg=0.4.7

FFmpeg FFmpeg=0.4.8

FFmpeg FFmpeg=0.4.9

FFmpeg FFmpeg=0.4.9-pre1

FFmpeg FFmpeg=0.5

FFmpeg FFmpeg=0.5.1

FFmpeg FFmpeg=0.5.2

FFmpeg FFmpeg=0.5.3

FFmpeg FFmpeg=0.5.4

FFmpeg FFmpeg=0.5.4.5

FFmpeg FFmpeg=0.5.4.6

FFmpeg FFmpeg=0.6

FFmpeg FFmpeg=0.6.1

FFmpeg FFmpeg=0.6.2

FFmpeg FFmpeg=0.6.3

FFmpeg FFmpeg=0.7

FFmpeg FFmpeg=0.7.1

FFmpeg FFmpeg=0.7.2

FFmpeg FFmpeg=0.7.3

FFmpeg FFmpeg=0.7.4

FFmpeg FFmpeg=0.7.5

FFmpeg FFmpeg=0.7.6

FFmpeg FFmpeg=0.7.7

FFmpeg FFmpeg=0.7.8

FFmpeg FFmpeg=0.7.9

FFmpeg FFmpeg=0.7.11

FFmpeg FFmpeg=0.7.12

FFmpeg FFmpeg=0.8.0

FFmpeg FFmpeg=0.8.1

FFmpeg FFmpeg=0.8.2

FFmpeg FFmpeg=0.8.5

FFmpeg FFmpeg=0.8.5.3

FFmpeg FFmpeg=0.8.5.4

FFmpeg FFmpeg=0.8.6

FFmpeg FFmpeg=0.8.7

FFmpeg FFmpeg=0.8.8

FFmpeg FFmpeg=0.8.10

FFmpeg FFmpeg=0.8.11

FFmpeg FFmpeg=0.9

FFmpeg FFmpeg=0.9.1

FFmpeg FFmpeg=0.10

FFmpeg FFmpeg=0.10.3

Libav Libav=0.7

Libav Libav=0.7-beta1

Libav Libav=0.7-beta2

Libav Libav=0.7.1

Libav Libav=0.7.2

Libav Libav=0.7.3

Libav Libav=0.7.4

Libav Libav=0.7.5

Libav Libav=0.7.6

Remediation

Patch Available

http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=cb7190cd2c691fd93e4d3664f3fce6c19ee001dd

Event History

Sep 10, 2012

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2012-2772?

The severity of CVE-2012-2772 is currently unknown due to unspecified impact and attack vectors.

How do I fix CVE-2012-2772?