CVE-2009-0385 — Ffmpeg vulnerability

8 documents5 sources
Severity
9.3CRITICALNVD
NVD7.5
EPSS
11.6%
top 6.34%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
9
FfmpegMplayerDebian Ffmpeg+6 more
Timeline
PublishedFeb 2
Latest updateMay 2

Description

Integer signedness error in the fourxm_read_header function in libavformat/4xm.c in FFmpeg before revision 16846 allows remote attackers to execute arbitrary code via a malformed 4X movie file with a large current_track value, which triggers a NULL pointer dereference.

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages7 packages

▶NVDffmpeg/ffmpeg< 0.6.3
▶debiandebian/ffmpeg< ffmpeg 0.svn20080206-16 (bookworm)
▶Debianffmpeg/ffmpeg< 0.svn20080206-16+3
▶debiandebian/mplayer< ffmpeg 0.svn20080206-16 (bookworm)
▶Debianmplayer/mplayer< 1.0~rc2-14+3

Also affects: Debian Linux 4.0, 5.0, 6.0, Fedora 10, 9, Ubuntu Linux 7.10, 8.04, 8.10

🔴Vulnerability Details

3
GHSA
GHSA-jhxf-rmj6-ghq6: Integer overflow in the 4xm demuxer (demuxers/demux_4xm↗2022-05-02
▶
GHSA
GHSA-h3wc-jxm7-mr49: Integer signedness error in the fourxm_read_header function in libavformat/4xm↗2022-05-02
▶
OSV
CVE-2009-0385: Integer signedness error in the fourxm_read_header function in libavformat/4xm↗2009-02-02
▶

📋Vendor Advisories

3
Ubuntu
FFmpeg vulnerabilities↗2009-03-16
▶
Debian
CVE-2009-0385: ffmpeg - Integer signedness error in the fourxm_read_header function in libavformat/4xm.c...↗2009
▶
Debian
CVE-2009-0698: vlc - Integer overflow in the 4xm demuxer (demuxers/demux_4xm.c) in xine-lib 1.1.16.1 ...↗2009
▶