CVE-2013-3670

published 2013-06-10

CVE-2013-3670: The rle_unpack function in vmdav.c in libavcodec in FFmpeg git 20130328 through 20130501 does not properly use the bytestream2 API, which allows remote…

Priority P4 16 medium 4.3 CVSS 2.0

AV N AC M Au N C N I N A P

The rle_unpack function in vmdav.c in libavcodec in FFmpeg git 20130328 through 20130501 does not properly use the bytestream2 API, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted RLE data. NOTE: the vendor has listed this as an issue fixed in 1.2.1, but the issue is actually in new code that was not shipped with the 1.2.1 release or any earlier release.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
debian	ffmpeg	< ffmpeg 7:2.4.1-1 (bookworm)	ffmpeg 7:2.4.1-1 (bookworm)
ffmpeg	ffmpeg	<= 1.2	—
ffmpeg	ffmpeg	>= 0 < 7:2.4.1-1	7:2.4.1-1
ffmpeg	ffmpeg	>= 0 < 7:2.4.1-1	7:2.4.1-1
ffmpeg	ffmpeg	>= 0 < 7:2.4.1-1	7:2.4.1-1
ffmpeg	ffmpeg	>= 0 < 7:2.4.1-1	7:2.4.1-1

CVSS provenance

nvd v2.0 4.3 MEDIUM AV:N/AC:M/Au:N/C:N/I:N/A:P

osv 4.3 MEDIUM

vendor_debian 4.3 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-119