CVE-2012-0853 — Improper Input Validation in Ffmpeg

CWE-20 — Improper Input Validation6 documents5 sources
Severity
6.8MEDIUMNVD
EPSS
1.2%
top 21.11%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
FfmpegDebian FfmpegLibav
Timeline
PublishedAug 20
Latest updateMay 17

Description

The decodeTonalComponents function in the Actrac3 codec (atrac3.c) in libavcodec in FFmpeg 0.7.x before 0.7.12, and 0.8.x before 0.8.11; and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.5, and 0.8.x before 0.8.1 allows remote attackers to cause a denial of service (infinite loop and crash) and possibly execute arbitrary code via a large component count in an Atrac 3 file.

CVSS vector

AV:N/AC:M/C:P/I:P/A:PExploitability: 8.6 | Impact: 6.4

Affected Packages4 packages

▶debiandebian/ffmpeg< ffmpeg 7:2.4.1-1 (bookworm)
▶Debianffmpeg/ffmpeg< 7:2.4.1-1+3
▶NVDlibav/libav20 versions+19
▶NVDffmpeg/ffmpeg17 versions+16

🔴Vulnerability Details

2
GHSA
GHSA-q2r7-wvw8-54qr: The decodeTonalComponents function in the Actrac3 codec (atrac3↗2022-05-17
▶
OSV
CVE-2012-0853: The decodeTonalComponents function in the Actrac3 codec (atrac3↗2012-08-20
▶

📋Vendor Advisories

3
Ubuntu
FFmpeg vulnerabilities↗2012-06-18
▶
Ubuntu
Libav vulnerabilities↗2012-06-18
▶
Debian
CVE-2012-0853: ffmpeg - The decodeTonalComponents function in the Actrac3 codec (atrac3.c) in libavcodec...↗2012
▶