CVE-2012-2803: Double Free

Q: What is the severity of CVE-2012-2803?

The severity of CVE-2012-2803 is currently unknown due to the unspecified impact and attack vectors associated with the vulnerability.

Q: How do I fix CVE-2012-2803?

To fix CVE-2012-2803, update to FFmpeg versions newer than 0.10.4 or Libav versions 0.7.7 and 0.8.5 or later.

Q: Which software versions are affected by CVE-2012-2803?

CVE-2012-2803 affects FFmpeg versions up to 0.10.4 and Libav versions prior to 0.7.7 and 0.8.5.

Q: What type of vulnerability is CVE-2012-2803?

CVE-2012-2803 is classified as a double free vulnerability in the mpeg_decode_frame function.

Q: Can I safely use affected versions of FFmpeg and Libav?

Using affected versions of FFmpeg and Libav is not recommended as they may expose your system to potential vulnerabilities.

Published Sep 10, 2012

Updated

Double free vulnerability in the mpegdecodeframe function in libavcodec/mpeg12.c in FFmpeg before 0.11, and Libav 0.7.x before 0.7.7 and 0.8.x before 0.8.5, has unknown impact and attack vectors, related to resetting the data size value.

Affected Software

69 affected components

Libav Libav=0.8

Libav Libav=0.8-beta2

Libav Libav=0.8.1

Libav Libav=0.8.2

Libav Libav=0.8.3

Libav Libav=0.8.4

FFmpeg FFmpeg<=0.10.4

FFmpeg FFmpeg=0.3

FFmpeg FFmpeg=0.3.1

FFmpeg FFmpeg=0.3.2

FFmpeg FFmpeg=0.3.3

FFmpeg FFmpeg=0.3.4

FFmpeg FFmpeg=0.4.0

FFmpeg FFmpeg=0.4.2

FFmpeg FFmpeg=0.4.3

FFmpeg FFmpeg=0.4.4

FFmpeg FFmpeg=0.4.5

FFmpeg FFmpeg=0.4.6

FFmpeg FFmpeg=0.4.7

FFmpeg FFmpeg=0.4.8

FFmpeg FFmpeg=0.4.9

FFmpeg FFmpeg=0.4.9-pre1

FFmpeg FFmpeg=0.5

FFmpeg FFmpeg=0.5.1

FFmpeg FFmpeg=0.5.2

FFmpeg FFmpeg=0.5.3

FFmpeg FFmpeg=0.5.4

FFmpeg FFmpeg=0.5.4.5

FFmpeg FFmpeg=0.5.4.6

FFmpeg FFmpeg=0.6

FFmpeg FFmpeg=0.6.1

FFmpeg FFmpeg=0.6.2

FFmpeg FFmpeg=0.6.3

FFmpeg FFmpeg=0.7

FFmpeg FFmpeg=0.7.1

FFmpeg FFmpeg=0.7.2

FFmpeg FFmpeg=0.7.3

FFmpeg FFmpeg=0.7.4

FFmpeg FFmpeg=0.7.5

FFmpeg FFmpeg=0.7.6

FFmpeg FFmpeg=0.7.7

FFmpeg FFmpeg=0.7.8

FFmpeg FFmpeg=0.7.9

FFmpeg FFmpeg=0.7.11

FFmpeg FFmpeg=0.7.12

FFmpeg FFmpeg=0.8.0

FFmpeg FFmpeg=0.8.1

FFmpeg FFmpeg=0.8.2

FFmpeg FFmpeg=0.8.5

FFmpeg FFmpeg=0.8.5.3

FFmpeg FFmpeg=0.8.5.4

FFmpeg FFmpeg=0.8.6

FFmpeg FFmpeg=0.8.7

FFmpeg FFmpeg=0.8.8

FFmpeg FFmpeg=0.8.10

FFmpeg FFmpeg=0.8.11

FFmpeg FFmpeg=0.9

FFmpeg FFmpeg=0.9.1

FFmpeg FFmpeg=0.10

FFmpeg FFmpeg=0.10.3

Libav Libav=0.7

Libav Libav=0.7-beta1

Libav Libav=0.7-beta2

Libav Libav=0.7.1

Libav Libav=0.7.2

Libav Libav=0.7.3

Libav Libav=0.7.4

Libav Libav=0.7.5

Libav Libav=0.7.6

Event History

Sep 10, 2012

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2012-2803?

The severity of CVE-2012-2803 is currently unknown due to the unspecified impact and attack vectors associated with the vulnerability.

How do I fix CVE-2012-2803?

To fix CVE-2012-2803, update to FFmpeg versions newer than 0.10.4 or Libav versions 0.7.7 and 0.8.5 or later.

Which software versions are affected by CVE-2012-2803?