Description
flicvideo.c in libavcodec 0.6 and earlier in FFmpeg, as used in MPlayer and other products, allows remote attackers to execute arbitrary code via a crafted flic file, related to an "arbitrary offset dereference vulnerability."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ffmpeg | 4:0.5.2-6 | — |
| Debian 13 | ffmpeg | 4:0.5.2-6 | — |
| Debian 12 | ffmpeg | 4:0.5.2-6 | — |
| Debian 5.0 | ffmpeg-debian | 0.svn20080206-18+lenny3 | DSA-2165-1 |
Advisories 1
- DSA-2165-1 ffmpeg-debian - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
References
- MDVSA-2011:088 vendor-advisory
- [oss-security] 20100928 [oCERT-2010-004] FFmpeg/libavcodec arbitrary offset dereference mailing-list
- http://git.ffmpeg.org/?p=ffmpeg%3Ba=commit%3Bh=16c592155f117ccd7b86006c45aacc692a81c23b
- MDVSA-2011:061 vendor-advisory
- MDVSA-2011:062 vendor-advisory
- 20100928 [oCERT-2010-004] FFmpeg/libavcodec arbitrary offset dereference mailing-list
- MDVSA-2011:112 vendor-advisory
- MDVSA-2011:114 vendor-advisory
- 43323 third-party-advisory
- USN-1104-1 vendor-advisory
- ADV-2010-2518 vdb-entry
- MDVSA-2011:089 vendor-advisory
- ADV-2010-2517 vdb-entry
- DSA-2165 vendor-advisory
- ADV-2011-1241 vdb-entry
- MDVSA-2011:060 vendor-advisory
- 41626 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=635775
- http://www.ocert.org/advisories/ocert-2010-004.html