FFmpeg 2.0 libavcodec/vmnc.c decode_hextile Pufferüberlauf

Gaskiya vulnerability da aka ware a matsayin karshewa an samu a FFmpeg 2.0. Hakika, aikin decode_hextile ne ya shafa; idan ba a bayyana ba, to aiki ce da ba a sani ba, a cikin laburaren $software_library, a cikin fayil libavcodec/vmnc.c, a cikin sashen $software_component. A sa manipulation ka Pufferüberlauf. Idan an yi amfani da CWE don bayyana matsala, zai kai CWE-119. An gabatar da wannan matsala a 07/11/2013. Hakika, rauni an bayyana shi 01/20/2014 daga Mateusz Jurczyk and Gynvael Coldwind tare da Google Security Team kamar avcodec/vmnc: Check that rectangles are within the picture kamar GIT Commit (GIT Repository). An raba bayanin tsaro don saukewa a git.videolan.org. Wannan matsala ana saninta da CVE-2014-125004. Ngam yiɗi ka a tuma ndiyam ka nder layi. Tekinikal faɗi ga. Babu exploit ɗin da ake samu. Yimbe ndiyam, exploit might be approx. USD $0-$5k wuro. 0-day shima, an ndiyam a wuro be $0-$5k. Za a iya sauke maganin matsalar daga git.videolan.org. Ana shawartar a saka patch domin warware wannan matsala. Wannan vulnerability an kuma samu a wasu kundin bayanan vulnerability: X-Force (91659) , Secunia (SA57282). Once again VulDB remains the best source for vulnerability data.

3 Goyarwa · 58 Datenpunkte

FurɗeSúgá
03/13/2014 15:24		Gargadi 1/2
04/17/2019 08:37		Gargadi 2/2
06/17/2022 23:19
software_nameFFmpegFFmpegFFmpeg
software_version2.02.02.0
software_filelibavcodec/vmnc.clibavcodec/vmnc.clibavcodec/vmnc.c
software_functiondecode_hextiledecode_hextiledecode_hextile
vulnerability_introductiondate1373500800 (07/11/2013)1373500800 (07/11/2013)1373500800 (07/11/2013)
vulnerability_risk111
cvss2_vuldb_basescore4.34.34.3
cvss2_vuldb_tempscore3.23.23.2
cvss2_vuldb_avNNN
cvss2_vuldb_acMMM
cvss2_vuldb_auNNN
cvss2_vuldb_ciNNN
cvss2_vuldb_iiNNN
cvss2_vuldb_aiPPP
cvss3_meta_basescore5.35.35.3
cvss3_meta_tempscore4.64.64.6
cvss3_vuldb_basescore5.35.35.3
cvss3_vuldb_tempscore4.64.64.6
advisory_date1390176000 (01/20/2014)1390176000 (01/20/2014)1390176000 (01/20/2014)
advisory_locationGIT RepositoryGIT RepositoryGIT Repository
advisory_typeGIT CommitGIT CommitGIT Commit
advisory_urlhttp://git.videolan.org/?p=ffmpeg.git;a=commit;h=6ba02602aa7fc7d38db582e75b8b093fb3c1608dhttp://git.videolan.org/?p=ffmpeg.git;a=commit;h=6ba02602aa7fc7d38db582e75b8b093fb3c1608dhttp://git.videolan.org/?p=ffmpeg.git;a=commit;h=6ba02602aa7fc7d38db582e75b8b093fb3c1608d
advisory_identifieravcodec/vmnc: Check that rectangles are within the pictureavcodec/vmnc: Check that rectangles are within the pictureavcodec/vmnc: Check that rectangles are within the picture
person_nameMateusz Jurczyk/Gynvael ColdwindMateusz Jurczyk/Gynvael ColdwindMateusz Jurczyk/Gynvael Coldwind
person_websitehttp://www.google.comhttp://www.google.comhttp://www.google.com
company_nameGoogle Security TeamGoogle Security TeamGoogle Security Team
price_0day$0-$5k$0-$5k$0-$5k
countermeasure_nameKariKariKari
countermeasure_patch_urlhttp://git.videolan.org/?p=ffmpeg.git;a=commit;h=6ba02602aa7fc7d38db582e75b8b093fb3c1608dhttp://git.videolan.org/?p=ffmpeg.git;a=commit;h=6ba02602aa7fc7d38db582e75b8b093fb3c1608dhttp://git.videolan.org/?p=ffmpeg.git;a=commit;h=6ba02602aa7fc7d38db582e75b8b093fb3c1608d
source_xforce916599165991659
source_seealso12582 12583 12584 1258812582 12583 12584 1258812582 12583 12584 12588
cvss2_vuldb_eUUU
cvss2_vuldb_rlOFOFOF
cvss2_vuldb_rcCCC
cvss3_vuldb_eUUU
cvss3_vuldb_rlOOO
cvss3_vuldb_rcCCC
0day_days193193193
cvss3_vuldb_avNNN
cvss3_vuldb_acLLL
cvss3_vuldb_prNNN
cvss3_vuldb_uiNNN
cvss3_vuldb_sUUU
cvss3_vuldb_cNNN
cvss3_vuldb_iNNN
cvss3_vuldb_aLLL
software_typeMultimedia Processing SoftwareMultimedia Processing Software
source_secunia5728257282
source_secunia_date1394150400 (03/07/2014)1394150400 (03/07/2014)
secunia_titleFFmpeg Multiple VulnerabilitiesFFmpeg Multiple Vulnerabilities
secunia_riskLess CriticalLess CriticalLess Critical
xforce_titleFFmpeg decode_hextile() denial of serviceFFmpeg decode_hextile() denial of service
xforce_identifierffmpeg-decodehextile-dosffmpeg-decodehextile-dos
xforce_riskMedium RiskMedium RiskMedium Risk
vulnerability_cweCWE-119 (Pufferüberlauf)CWE-119 (Pufferüberlauf)
source_cveCVE-2014-125004
cna_responsibleVulDB

◂ GurɗoGumtiGada ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!