CVE-2013-0862: Integer Overflow

Q: What is the severity of CVE-2013-0862?

CVE-2013-0862 has a severity rating that indicates it can lead to remote code execution due to integer overflows.

Q: How do I fix CVE-2013-0862?

To fix CVE-2013-0862, upgrade FFmpeg to version 1.1.2 or later.

Q: Which versions of FFmpeg are affected by CVE-2013-0862?

CVE-2013-0862 affects all FFmpeg versions prior to 1.1.2, including versions 0.3.0 through 1.1.1.

Q: What impact can CVE-2013-0862 have on my system?

CVE-2013-0862 can cause an unspecified impact, allowing remote attackers to exploit the vulnerability through crafted media files.

Q: How can I determine if my FFmpeg version is vulnerable to CVE-2013-0862?

Check your FFmpeg version against the official release notes to confirm if it is prior to version 1.1.2, which is vulnerable.

Published Nov 23, 2013

Updated

Multiple integer overflows in the processframeobj function in libavcodec/sanm.c in FFmpeg before 1.1.2 allow remote attackers to have an unspecified impact via crafted image dimensions in LucasArts Smush video data, which triggers an out-of-bounds array access.

Affected Software

59 affected components

FFmpeg FFmpeg<=1.1.1

FFmpeg FFmpeg=0.3

FFmpeg FFmpeg=0.3.1

FFmpeg FFmpeg=0.3.2

FFmpeg FFmpeg=0.3.3

FFmpeg FFmpeg=0.3.4

FFmpeg FFmpeg=0.4.0

FFmpeg FFmpeg=0.4.2

FFmpeg FFmpeg=0.4.3

FFmpeg FFmpeg=0.4.4

FFmpeg FFmpeg=0.4.5

FFmpeg FFmpeg=0.4.6

FFmpeg FFmpeg=0.4.7

FFmpeg FFmpeg=0.4.8

FFmpeg FFmpeg=0.4.9-pre1

FFmpeg FFmpeg=0.5

FFmpeg FFmpeg=0.5.1

FFmpeg FFmpeg=0.5.2

FFmpeg FFmpeg=0.5.3

FFmpeg FFmpeg=0.5.4

FFmpeg FFmpeg=0.5.4.5

FFmpeg FFmpeg=0.5.4.6

FFmpeg FFmpeg=0.6

FFmpeg FFmpeg=0.6.1

FFmpeg FFmpeg=0.6.2

FFmpeg FFmpeg=0.6.3

FFmpeg FFmpeg=0.7

FFmpeg FFmpeg=0.7.1

FFmpeg FFmpeg=0.7.2

FFmpeg FFmpeg=0.7.3

FFmpeg FFmpeg=0.7.4

FFmpeg FFmpeg=0.7.5

FFmpeg FFmpeg=0.7.6

FFmpeg FFmpeg=0.7.7

FFmpeg FFmpeg=0.7.8

FFmpeg FFmpeg=0.7.9

FFmpeg FFmpeg=0.7.11

FFmpeg FFmpeg=0.7.12

FFmpeg FFmpeg=0.8.0

FFmpeg FFmpeg=0.8.1

FFmpeg FFmpeg=0.8.2

FFmpeg FFmpeg=0.8.5

FFmpeg FFmpeg=0.8.5.3

FFmpeg FFmpeg=0.8.5.4

FFmpeg FFmpeg=0.8.6

FFmpeg FFmpeg=0.8.7

FFmpeg FFmpeg=0.8.8

FFmpeg FFmpeg=0.8.10

FFmpeg FFmpeg=0.8.11

FFmpeg FFmpeg=0.9

FFmpeg FFmpeg=0.9.1

FFmpeg FFmpeg=0.10

FFmpeg FFmpeg=0.10.3

FFmpeg FFmpeg=0.10.4

FFmpeg FFmpeg=0.11

FFmpeg FFmpeg=1.0

FFmpeg FFmpeg=1.0.1

FFmpeg FFmpeg=1.0.2

FFmpeg FFmpeg=1.0.3

Remediation

Patch Available

http://git.videolan.org/?p=ffmpeg.git;a=commit;h=f4fb841ad13bab66d4fb0c7ff2a94770df7815d8

Event History

Nov 23, 2013

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2013-0862?

CVE-2013-0862 has a severity rating that indicates it can lead to remote code execution due to integer overflows.

How do I fix CVE-2013-0862?