Lucene search

[email protected]CVE-2012-0859

HistoryAug 20, 2012 - 6:55 p.m.

CVE-2012-0859

2012-08-2018:55:02

CWE-119

[email protected]

web.nvd.nist.gov

cve-2012-0859

render_line function

vorbis codec

libavcodec

ffmpeg

denial of service

application crash

arbitrary code

vorbis file

vulnerability

incomplete fix

cve-2011-3893

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

9.4 High

AI Score

Confidence

High

0.021 Low

EPSS

Percentile

89.2%

JSON

The render_line function in the vorbis codec (vorbis.c) in libavcodec in FFmpeg before 0.9.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted Vorbis file, related to a large multiplier. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3893.

Affected configurations

NVD

Node

ffmpegffmpegRange≤0.9

ffmpegffmpegMatch0.7.1

ffmpegffmpegMatch0.7.2

ffmpegffmpegMatch0.7.7

ffmpegffmpegMatch0.7.8

ffmpegffmpegMatch0.7.9

ffmpegffmpegMatch0.7.11

ffmpegffmpegMatch0.7.12

ffmpegffmpegMatch0.8.5

ffmpegffmpegMatch0.8.6

ffmpegffmpegMatch0.8.7

ffmpegffmpegMatch0.8.8

ffmpegffmpegMatch0.8.10

ffmpegffmpegMatch0.8.11

CPENameOperatorVersion
ffmpeg:ffmpegffmpegle0.9
ffmpeg:ffmpegffmpegeq0.7.1
ffmpeg:ffmpegffmpegeq0.7.2
ffmpeg:ffmpegffmpegeq0.7.7
ffmpeg:ffmpegffmpegeq0.7.8
ffmpeg:ffmpegffmpegeq0.7.9
ffmpeg:ffmpegffmpegeq0.7.11
ffmpeg:ffmpegffmpegeq0.7.12
ffmpeg:ffmpegffmpegeq0.8.5
ffmpeg:ffmpegffmpegeq0.8.6

CPE	Name	Operator	Version
ffmpeg:ffmpeg	ffmpeg	le	0.9
ffmpeg:ffmpeg	ffmpeg	eq	0.7.1
ffmpeg:ffmpeg	ffmpeg	eq	0.7.2
ffmpeg:ffmpeg	ffmpeg	eq	0.7.7
ffmpeg:ffmpeg	ffmpeg	eq	0.7.8
ffmpeg:ffmpeg	ffmpeg	eq	0.7.9
ffmpeg:ffmpeg	ffmpeg	eq	0.7.11
ffmpeg:ffmpeg	ffmpeg	eq	0.7.12
ffmpeg:ffmpeg	ffmpeg	eq	0.8.5
ffmpeg:ffmpeg	ffmpeg	eq	0.8.6