Description
The read_header function in libavcodec/ffv1dec.c in FFmpeg before 2.1 does not prevent changes to global parameters, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted FFV1 data.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ffmpeg | 7:2.4.1-1 | — |
| Debian 13 | ffmpeg | 7:2.4.1-1 | — |
| Debian 12 | ffmpeg | 7:2.4.1-1 | — |
References
- https://github.com/FFmpeg/FFmpeg/commit/547d690d676064069d44703a1917e0dab7e33445
- https://trac.ffmpeg.org/ticket/2906
- GLSA-201603-06 vendor-advisory
- http://ffmpeg.org/security.html
- [oss-security] 20131208 Re: CVE Request: FFmpeg 2.1 multiple problems mailing-list
- [oss-security] 20131126 CVE Request: FFmpeg 2.1 multiple problems mailing-list