CVE-2009-4635

published 2010-02-10

CVE-2009-4635: FFmpeg 0.5 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted MOV container with improperly ordered tags…

Priority P3 48 critical 9.3 CVSS 2.0

AV N AC M Au N C C I C A C

FFmpeg 0.5 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted MOV container with improperly ordered tags that cause (1) mov.c and (2) utils.c to use inconsistent codec types and identifiers, leading to processing of a video-structure pointer by the mp3 decoder, and a stack-based buffer overflow.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
debian	ffmpeg	< ffmpeg 4:0.5+svn20090706-3 (bookworm)	ffmpeg 4:0.5+svn20090706-3 (bookworm)
ffmpeg	ffmpeg	—	—
ffmpeg	ffmpeg	>= 0 < 4:0.5+svn20090706-3	4:0.5+svn20090706-3
ffmpeg	ffmpeg	>= 0 < 4:0.5+svn20090706-3	4:0.5+svn20090706-3
ffmpeg	ffmpeg	>= 0 < 4:0.5+svn20090706-3	4:0.5+svn20090706-3
ffmpeg	ffmpeg	>= 0 < 4:0.5+svn20090706-3	4:0.5+svn20090706-3

CVSS provenance

nvd v2.0 9.3 CRITICAL AV:N/AC:M/Au:N/C:C/I:C/A:C

osv 9.3 CRITICAL

vendor_debian 9.3 CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-94