CVE-2013-2277: High severity ffmpeg vulnerability

Q: What is the severity of CVE-2013-2277?

The severity of CVE-2013-2277 is categorized as high due to its potential to cause denial of service.

Q: How do I fix CVE-2013-2277?

To fix CVE-2013-2277, upgrade to FFmpeg version 1.1.3 or later.

Q: What type of vulnerability is CVE-2013-2277?

CVE-2013-2277 is a vulnerability related to improper validation of video parameters in FFmpeg.

Q: Which versions of FFmpeg are affected by CVE-2013-2277?

FFmpeg versions prior to 1.1.3, as well as versions 0.3 to 1.1.2, are affected by CVE-2013-2277.

Q: What are the potential impacts of CVE-2013-2277?

The potential impacts of CVE-2013-2277 include application crashes and denial of service due to out-of-bounds array access.

Published Feb 27, 2013

Updated

The ffh264decodeseqparameterset function in h264ps.c in libavcodec in FFmpeg before 1.1.3 does not validate the relationship between luma depth and chroma depth, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via crafted H.264 data.

Affected Software

58 affected components

FFmpeg FFmpeg<=1.1.2

FFmpeg FFmpeg=0.3

FFmpeg FFmpeg=0.3.1

FFmpeg FFmpeg=0.3.2

FFmpeg FFmpeg=0.3.3

FFmpeg FFmpeg=0.3.4

FFmpeg FFmpeg=0.4.0

FFmpeg FFmpeg=0.4.2

FFmpeg FFmpeg=0.4.3

FFmpeg FFmpeg=0.4.4

FFmpeg FFmpeg=0.4.5

FFmpeg FFmpeg=0.4.6

FFmpeg FFmpeg=0.4.7

FFmpeg FFmpeg=0.4.8

FFmpeg FFmpeg=0.4.9

FFmpeg FFmpeg=0.4.9-pre1

FFmpeg FFmpeg=0.5

FFmpeg FFmpeg=0.5.1

FFmpeg FFmpeg=0.5.2

FFmpeg FFmpeg=0.5.3

FFmpeg FFmpeg=0.5.4

FFmpeg FFmpeg=0.5.4.5

FFmpeg FFmpeg=0.5.4.6

FFmpeg FFmpeg=0.6

FFmpeg FFmpeg=0.6.1

FFmpeg FFmpeg=0.6.2

FFmpeg FFmpeg=0.6.3

FFmpeg FFmpeg=0.7

FFmpeg FFmpeg=0.7.1

FFmpeg FFmpeg=0.7.2

FFmpeg FFmpeg=0.7.3

FFmpeg FFmpeg=0.7.4

FFmpeg FFmpeg=0.7.5

FFmpeg FFmpeg=0.7.6

FFmpeg FFmpeg=0.7.7

FFmpeg FFmpeg=0.7.8

FFmpeg FFmpeg=0.7.9

FFmpeg FFmpeg=0.7.11

FFmpeg FFmpeg=0.7.12

FFmpeg FFmpeg=0.8.0

FFmpeg FFmpeg=0.8.1

FFmpeg FFmpeg=0.8.2

FFmpeg FFmpeg=0.8.5

FFmpeg FFmpeg=0.8.5.3

FFmpeg FFmpeg=0.8.5.4

FFmpeg FFmpeg=0.8.6

FFmpeg FFmpeg=0.8.7

FFmpeg FFmpeg=0.8.8

FFmpeg FFmpeg=0.8.10

FFmpeg FFmpeg=0.8.11

FFmpeg FFmpeg=0.9

FFmpeg FFmpeg=0.9.1

FFmpeg FFmpeg=0.10

FFmpeg FFmpeg=0.10.3

FFmpeg FFmpeg=0.10.4

FFmpeg FFmpeg=0.11

FFmpeg FFmpeg=1.0

FFmpeg FFmpeg=1.1.1

Remediation

Patch Available

http://git.videolan.org/?p=ffmpeg.git;a=commit;h=bdeb61ccc67911cfc5e20c7cfb1312d0501ca90a

Event History

Feb 27, 2013

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2013-2277?

The severity of CVE-2013-2277 is categorized as high due to its potential to cause denial of service.

How do I fix CVE-2013-2277?