CVE-2012-0851 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Ffmpeg

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer6 documents5 sources
Severity
6.8MEDIUMNVD
EPSS
2.2%
top 15.67%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
FfmpegDebian FfmpegLibav
Timeline
PublishedAug 20
Latest updateMay 17

Description

The ff_h264_decode_seq_parameter_set function in h264_ps.c in libavcodec in FFmpeg before 0.9.1 and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.6, and 0.8.x before 0.8.3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted H.264 file, related to the chroma_format_idc value.

CVSS vector

AV:N/AC:M/C:P/I:P/A:PExploitability: 8.6 | Impact: 6.4

Affected Packages4 packages

▶debiandebian/ffmpeg< ffmpeg 7:2.4.1-1 (bookworm)
▶Debianffmpeg/ffmpeg< 7:2.4.1-1+3
▶NVDffmpeg/ffmpeg0.9+13
▶NVDlibav/libav23 versions+22

🔴Vulnerability Details

2
GHSA
GHSA-mh6c-cqhm-4rxx: The ff_h264_decode_seq_parameter_set function in h264_ps↗2022-05-17
▶
OSV
CVE-2012-0851: The ff_h264_decode_seq_parameter_set function in h264_ps↗2012-08-20
▶

📋Vendor Advisories

3
Ubuntu
FFmpeg vulnerabilities↗2012-06-18
▶
Ubuntu
Libav vulnerabilities↗2012-06-18
▶
Debian
CVE-2012-0851: ffmpeg - The ff_h264_decode_seq_parameter_set function in h264_ps.c in libavcodec in FFmp...↗2012
▶