CVE-2013-0858: Critical severity debian linux vulnerability
Published Dec 7, 2013
·Updated
The atrac3decodeinit function in libavcodec/atrac3.c in FFmpeg before 1.0.4 allows remote attackers to have an unspecified impact via ATRAC3 data with the joint stereo coding mode set and fewer than two channels.
Affected Software
58 affected components
Debian Debian Linux=7.0
FFmpeg FFmpeg<=1.0.3
FFmpeg FFmpeg=0.3
FFmpeg FFmpeg=0.3.1
FFmpeg FFmpeg=0.3.2
FFmpeg FFmpeg=0.3.3
FFmpeg FFmpeg=0.3.4
FFmpeg FFmpeg=0.4.0
FFmpeg FFmpeg=0.4.2
FFmpeg FFmpeg=0.4.3
FFmpeg FFmpeg=0.4.4
FFmpeg FFmpeg=0.4.5
FFmpeg FFmpeg=0.4.6
FFmpeg FFmpeg=0.4.7
FFmpeg FFmpeg=0.4.8
FFmpeg FFmpeg=0.4.9-pre1
FFmpeg FFmpeg=0.5
FFmpeg FFmpeg=0.5.1
FFmpeg FFmpeg=0.5.2
FFmpeg FFmpeg=0.5.3
FFmpeg FFmpeg=0.5.4
FFmpeg FFmpeg=0.5.4.5
FFmpeg FFmpeg=0.5.4.6
FFmpeg FFmpeg=0.6
FFmpeg FFmpeg=0.6.1
FFmpeg FFmpeg=0.6.2
FFmpeg FFmpeg=0.6.3
FFmpeg FFmpeg=0.7
FFmpeg FFmpeg=0.7.1
FFmpeg FFmpeg=0.7.2
FFmpeg FFmpeg=0.7.3
FFmpeg FFmpeg=0.7.4
FFmpeg FFmpeg=0.7.5
FFmpeg FFmpeg=0.7.6
FFmpeg FFmpeg=0.7.7
FFmpeg FFmpeg=0.7.8
FFmpeg FFmpeg=0.7.9
FFmpeg FFmpeg=0.7.11
FFmpeg FFmpeg=0.7.12
FFmpeg FFmpeg=0.8.0
FFmpeg FFmpeg=0.8.1
FFmpeg FFmpeg=0.8.2
FFmpeg FFmpeg=0.8.5
FFmpeg FFmpeg=0.8.5.3
FFmpeg FFmpeg=0.8.5.4
FFmpeg FFmpeg=0.8.6
FFmpeg FFmpeg=0.8.7
FFmpeg FFmpeg=0.8.8
FFmpeg FFmpeg=0.8.10
FFmpeg FFmpeg=0.8.11
FFmpeg FFmpeg=0.9
FFmpeg FFmpeg=0.9.1
FFmpeg FFmpeg=0.10
FFmpeg FFmpeg=0.10.3
FFmpeg FFmpeg=0.10.4
FFmpeg FFmpeg=0.11
FFmpeg FFmpeg=1.0.1
FFmpeg FFmpeg=1.0.2
Remediation
Event History
Dec 7, 2013
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2013-0858?
CVE-2013-0858 is considered to have a high impact due to potential remote exploitation.
2
How do I fix CVE-2013-0858?
To fix CVE-2013-0858, you should upgrade FFmpeg to version 1.0.4 or later, or apply patches if available.
3
Which versions of FFmpeg are affected by CVE-2013-0858?
FFmpeg versions prior to 1.0.4, as well as multiple previous versions including 0.3 up to 1.0.3, are affected by CVE-2013-0858.
4
Can CVE-2013-0858 be exploited remotely?
Yes, CVE-2013-0858 allows for remote exploitation through specially crafted ATRAC3 audio streams.
5
What is the nature of the vulnerability in CVE-2013-0858?
The vulnerability in CVE-2013-0858 relates to improper handling of ATRAC3 data with joint stereo coding mode being set.