CVE-2009-4635 — Code Injection in Ffmpeg

CWE-94 — Code Injection5 documents5 sources
Severity
9.3CRITICALNVD
EPSS
9.7%
top 7.05%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
FfmpegDebian Ffmpeg
Timeline
PublishedFeb 10
Latest updateMay 2

Description

FFmpeg 0.5 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted MOV container with improperly ordered tags that cause (1) mov.c and (2) utils.c to use inconsistent codec types and identifiers, leading to processing of a video-structure pointer by the mp3 decoder, and a stack-based buffer overflow.

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages3 packages

▶debiandebian/ffmpeg< ffmpeg 4:0.5+svn20090706-3 (bookworm)
▶Debianffmpeg/ffmpeg< 4:0.5+svn20090706-3+3
▶NVDffmpeg/ffmpeg0.5

🔴Vulnerability Details

2
GHSA
GHSA-45r9-j9h4-w6jw: FFmpeg 0↗2022-05-02
▶
OSV
CVE-2009-4635: FFmpeg 0↗2010-02-10
▶

📋Vendor Advisories

2
Ubuntu
FFmpeg vulnerabilities↗2010-04-19
▶
Debian
CVE-2009-4635: ffmpeg - FFmpeg 0.5 allows remote attackers to cause a denial of service and possibly exe...↗2009
▶