Wuro vulnerability wey an yi classify sey karshewa an gano shi a cikin FFmpeg 2.0. Gaskiya, decode_vol_header na da matsala; idan ba a sani ba, to wata aiki ce da ba a sani ba, $software_library na cikin lissafi, libavcodec/mpeg4videodec.c na cikin fayil, $software_component na cikin sashi. Ngam manipulation shi Pufferüberlauf. CWE shidin ka a yi bayani matsala sai ya kai CWE-119. Wannan matsala an kawo ta a 07/11/2013. Gaskiya, laifi an fitar da shi 02/20/2014 ta Mateusz Jurczyk and Gynvael Coldwind da Google Security Team a matsayin avcodec/mpeg4videodec: Check for bitstream overread in decode_vol_header() a matsayin GIT Commit (GIT Repository). Advisory ɗin ana rabawa don saukewa a git.videolan.org. Wannan rauni ana sayar da shi da suna CVE-2014-125005. Ngam yiɗi ka a tuma ndiyam ka nder internet. Tekinikal bayani ga. Ba exploit ɗin da ake da shi. A sa'i, exploit might be approx. USD $0-$5k ndiyam. Kama 0-day, an ndiyam a wuro be $0-$5k. Gyaran matsalar yana nan a shirye don saukewa a git.videolan.org. Ana so a yi patch don gyara wannan matsala. Vulnerability ɗin nan kuma an rubuta shi a wasu kundin bayanan vulnerability: X-Force (91658). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

3 Goyarwa · 54 Datenpunkte