FFmpeg 'libswscale' Buffer Overflow Vulnerability

Bugtraq ID:	32089
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 25 2008 12:00AM
Updated:	Nov 06 2008 05:55PM
Credit:	michael
Vulnerable:	Pardus Linux 2008 0 MPlayer MPlayer 0 FFmpeg libswscale 0
Not Vulnerable:

FFmpeg 'libswscale' Buffer Overflow Vulnerability

The 'libswscale' library from FFmpeg is prone to a remote buffer-overflow vulnerability because of insufficient boundary checks.

Remote attackers can exploit this issue by enticing victims into opening maliciously crafted files with an application that uses the affected library.

Successful exploits may allow attackers to execute arbitrary code within the context of an affected application. Failed exploit attempts will likely result in a denial of service.

FFmpeg 'libswscale' Buffer Overflow Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

FFmpeg 'libswscale' Buffer Overflow Vulnerability

Solution:
Fixes are available in the SVN repository. Please see the references for more information.

FFmpeg 'libswscale' Buffer Overflow Vulnerability

References:

• Do not attempt to use the unscaled yuv2rgb converter when height is odd (FFmpeg )
  
• FFmpeg Homepage (FFmpeg )