CVE-2012-0858 — Ffmpeg vulnerability

CWE-3996 documents5 sources
Severity
6.8MEDIUMNVD
EPSS
2.8%
top 13.88%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
FfmpegDebian FfmpegLibav
Timeline
PublishedAug 20
Latest updateMay 17

Description

The Shorten codec (shorten.c) in libavcodec in FFmpeg 0.7.x before 0.7.12 and 0.8.x before 0.8.11, and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.5, and 0.8.x before 0.8.1, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted Shorten file, related to an "invalid free".

CVSS vector

AV:N/AC:M/C:P/I:P/A:PExploitability: 8.6 | Impact: 6.4

Affected Packages4 packages

▶debiandebian/ffmpeg< ffmpeg 7:2.2.1-1 (bookworm)
▶Debianffmpeg/ffmpeg< 7:2.2.1-1+3
▶NVDlibav/libav20 versions+19
▶NVDffmpeg/ffmpeg12 versions+11

🔴Vulnerability Details

2
GHSA
GHSA-2pg8-mr5w-rhvw: The Shorten codec (shorten↗2022-05-17
▶
OSV
CVE-2012-0858: The Shorten codec (shorten↗2012-08-20
▶

📋Vendor Advisories

3
Ubuntu
FFmpeg vulnerabilities↗2012-06-18
▶
Ubuntu
Libav vulnerabilities↗2012-06-18
▶
Debian
CVE-2012-0858: ffmpeg - The Shorten codec (shorten.c) in libavcodec in FFmpeg 0.7.x before 0.7.12 and 0....↗2012
▶