CVE-2012-0947 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Libav

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer6 documents5 sources
Severity
6.8MEDIUMNVD
EPSS
3.5%
top 12.35%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
FfmpegDebian FfmpegLibav
Timeline
PublishedAug 20
Latest updateMay 17

Description

Heap-based buffer overflow in the vqa_decode_chunk function in the VQA codec (vqavideo.c) in libavcodec in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.6, and 0.8.x before 0.8.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted VQA media file in which the image size is not a multiple of the block size.

CVSS vector

AV:N/AC:M/C:P/I:P/A:PExploitability: 8.6 | Impact: 6.4

Affected Packages3 packages

▶NVDlibav/libav22 versions+21
▶debiandebian/ffmpeg< ffmpeg 7:2.4.1-1 (bookworm)
▶Debianffmpeg/ffmpeg< 7:2.4.1-1+3

🔴Vulnerability Details

2
GHSA
GHSA-mrcx-gg4f-hxqf: Heap-based buffer overflow in the vqa_decode_chunk function in the VQA codec (vqavideo↗2022-05-17
▶
OSV
CVE-2012-0947: Heap-based buffer overflow in the vqa_decode_chunk function in the VQA codec (vqavideo↗2012-08-20
▶

📋Vendor Advisories

3
Ubuntu
FFmpeg vulnerabilities↗2012-06-18
▶
Ubuntu
Libav vulnerabilities↗2012-06-18
▶
Debian
CVE-2012-0947: ffmpeg - Heap-based buffer overflow in the vqa_decode_chunk function in the VQA codec (vq...↗2012
▶