CVE-2013-3670

CVE-2013-3670 affects FFmpeg’s libavcodec: the rle_unpack function in vmdav.c (FFmpeg git 20130328 through 20130501) does not properly use the bytestream2 API, enabling a remote attacker to trigger a denial of service via crafted RLE data (out-of-bounds array access leading to an application cras...

PT-2013-4562

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 1.2.1 Description The issue is related to the cdg decode frame function in libavcodec, which does not validate the presence of non-header data in a buffer. This allows remote attackers to cause a denial of service,...

CVE-2013-3673: Improper Restriction of Operations within the Bounds of a Memory Buffer

The gifdecodeframe function in gifdec.c in libavcodec in FFmpeg before 1.2.1 does not properly manage the disposal methods of frames, which allows remote attackers to cause a denial of service out-of-bounds array access and application crash via crafted GIF data...

CVE-2013-3671: Undefined Security Weakness

The formatline function in log.c in libavutil in FFmpeg before 1.2.1 uses inapplicable offset data during a certain category calculation, which allows remote attackers to cause a denial of service invalid pointer dereference and application crash via crafted data that triggers a log message...

PT-2013-4559

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 1.2.1 Description The issue allows remote attackers to cause a denial of service, resulting in an invalid pointer dereference and application crash, via crafted data that triggers a log message. This is due to the form...

PT-2013-4561

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 1.2.1 Description The issue arises from the gif decode frame function in gifdec.c in libavcodec, which does not properly manage the disposal methods of frames. This allows remote attackers to cause a denial of service,...

CVE-2013-3672: Improper Input Validation

The mmdecodeinter function in mmvideo.c in libavcodec in FFmpeg before 1.2.1 does not validate the relationship between a horizontal coordinate and a width value, which allows remote attackers to cause a denial of service out-of-bounds array access and application crash via crafted American Laser...

PT-2013-4563

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 1.2.1 Description The issue is related to the process frame obj function in sanm.c within the libavcodec component of FFmpeg. This function does not validate width and height values, allowing remote attackers to cause ...

CVE-2013-3675: Improper Input Validation

The processframeobj function in sanm.c in libavcodec in FFmpeg before 1.2.1 does not validate width and height values, which allows remote attackers to cause a denial of service integer overflow, out-of-bounds array access, and application crash via crafted LucasArts Smush video data...

CVE-2013-3674: Improper Input Validation

The cdgdecodeframe function in cdgraphics.c in libavcodec in FFmpeg before 1.2.1 does not validate the presence of non-header data in a buffer, which allows remote attackers to cause a denial of service out-of-bounds array access and application crash via crafted CD Graphics Video data...

PT-2013-4560

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 1.2.1 Description The issue is related to the mm decode inter function in mmvideo.c in libavcodec, which does not validate the relationship between a horizontal coordinate and a width value. This allows remote attacker...

PT-2013-4558

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 1.2.1 Description The issue is related to the rle unpack function in vmdav.c in libavcodec, which does not properly use the bytestream2 API. This allows remote attackers to cause a denial of service, resulting in...

CVE-2013-3670: Improper Restriction of Operations within the Bounds of a Memory Buffer

The rleunpack function in vmdav.c in libavcodec in FFmpeg git 20130328 through 20130501 does not properly use the bytestream2 API, which allows remote attackers to cause a denial of service out-of-bounds array access and application crash via crafted RLE data. NOTE: the vendor has listed this as ...

VULNERABLE and COMPLETELY outdated 3rd-party libraries/components used in 3CX Phone 6

Hi @ll, the current 3CXPhone6.msi for Windows, available from http://www.3cx.com/VOIP/sip-phone/, digitally signed on 2012-07-30, installs the following outdated and vulnerable 3rd-party libraries: libeay32.dll and ssleay32.dll version 0.9.8h from 2008-05-28 of OpenSSL. The current version of...

3CX Phone outdated libraries

Outdated versions of OpenSSL and FFmpeg/FFdshow are used...

Mandriva Linux Security Advisory : ffmpeg (MDVSA-2013:079)

Updated ffmpeg packages fix security vulnerabilities : h264: Add check for invalid chromaformatidc CVE-2012-0851 h263dec: Disallow width/height changing with frame threads CVE-2011-3937 vc1dec: check that coded slice positions and interlacing match. This fixes out of array writes CVE-2012-2796...

libav / ffmpeg multiple security vulnerabilities

Vulnerabilities on multiple media formats parsing...

CVE-2013-0224

The Video module 7.x-2.x before 7.x-2.9 for Drupal, when using the FFmpeg transcoder, allows local users to execute arbitrary PHP code by modifying a temporary PHP file...

Code injection

The Video module 7.x-2.x before 7.x-2.9 for Drupal, when using the FFmpeg transcoder, allows local users to execute arbitrary PHP code by modifying a temporary PHP file...

CVE-2013-0224

The CVE-2013-0224 vulnerability affects the Drupal Video module (7.x-2.x) prior to 7.x-2.9 when using the FFmpeg transcoder. A local attacker can cause arbitrary PHP code execution by modifying a temporary PHP file used to store FFmpeg-related data; exploitation relies on write access to that tem...