CVE-2014-4610: Integer Overflow

Q: What is the severity of CVE-2014-4610?

CVE-2014-4610 has a high severity rating due to its potential for remote code execution.

Q: How do I fix CVE-2014-4610?

To fix CVE-2014-4610, upgrade FFmpeg to version 0.10.14 or later, or the appropriate patch version for other affected releases.

Q: Which FFmpeg versions are affected by CVE-2014-4610?

CVE-2014-4610 affects FFmpeg versions before 0.10.14, and 1.1.x before 1.1.12, 1.2.x before 1.2.7, 2.0.x before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.4.

Q: What causes the vulnerability CVE-2014-4610?

CVE-2014-4610 is caused by an integer overflow in the get_len function in libavutil/lzo.c.

Q: Can CVE-2014-4610 be exploited remotely?

Yes, CVE-2014-4610 can be exploited by remote attackers through specially crafted input.

Published Jan 14, 2020

Updated

Integer overflow in the getlen function in libavutil/lzo.c in FFmpeg before 0.10.14, 1.1.x before 1.1.12, 1.2.x before 1.2.7, 2.0.x before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.4 allows remote attackers to execute arbitrary code via a crafted Literal Run.

Affected Software

6 affected components

FFmpeg FFmpeg<0.10.14

FFmpeg FFmpeg>=1.1<1.1.12

FFmpeg FFmpeg>=1.2<1.2.7

FFmpeg FFmpeg>=2.0<2.0.5

FFmpeg FFmpeg>=2.1<2.1.5

FFmpeg FFmpeg>=2.2<2.2.4

Remediation

Patch Available

https://www.ffmpeg.org/security.html

Event History

Jan 14, 2020

CVE Published

via MITRE·03:41 PM

Data Sourced

via MITRE·03:41 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-4610?

CVE-2014-4610 has a high severity rating due to its potential for remote code execution.

How do I fix CVE-2014-4610?