REDHAT-BUG-2493952: High severity FFmpeg RASC video decoder (decode_dlta in libavcodec/rasc.c) vulnerability
FFmpeg's RASC video decoder (decodedlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXTLINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2493952?
The severity of REDHAT-BUG-2493952 is high with a risk rating of 7.
What are the potential impacts of REDHAT-BUG-2493952?
REDHAT-BUG-2493952 can lead to potential buffer overflows and memory access violations in the FFmpeg RASC video decoder.
How do I fix REDHAT-BUG-2493952?
To fix REDHAT-BUG-2493952, you should update to the latest version of FFmpeg that addresses this security vulnerability.
Which software is affected by REDHAT-BUG-2493952?
REDHAT-BUG-2493952 affects the FFmpeg RASC video decoder found in libavcodec.
What components of the FFmpeg are involved in REDHAT-BUG-2493952?
The components involved in REDHAT-BUG-2493952 are primarily the decode_dlta function and the handling of row boundary checks in the RASC video decoder.