FFmpeg Prior to 2.1 Multiple Remote Vulnerabilities

Bugtraq ID:	63936
Class:	Unknown
CVE:	CVE-2013-7008 CVE-2013-7009 CVE-2013-7010 CVE-2013-7011 CVE-2013-7012 CVE-2013-7013 CVE-2013-7014 CVE-2013-7015 CVE-2013-7016 CVE-2013-7017 CVE-2013-7018 CVE-2013-7019 CVE-2013-7020 CVE-2013-7021 CVE-2013-7022 CVE-2013-7023 CVE-2013-7024
Remote:	Yes
Local:	No
Published:	Nov 26 2013 12:00AM
Updated:	Jul 05 2016 09:43PM
Credit:	ami_stuff, Piotr Bandurski, Laurent Butti and the vendor reported these issues.
Vulnerable:	Gentoo Linux Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:

FFmpeg Prior to 2.1 Multiple Remote Vulnerabilities

FFmpeg is prone to multiple remote vulnerabilities.

Attackers may leverage these issues to execute arbitrary code in the context of the application or crash the application.

FFmpeg versions prior to 2.1 are vulnerable.

FFmpeg Prior to 2.1 Multiple Remote Vulnerabilities

Sample proof-of-concept files are available in the FFMpeg bug reports. Please see the references for more information.

FFmpeg Prior to 2.1 Multiple Remote Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.


Mandriva Business Server 1 X86 64

• Mandriva ffmpeg-0.10.15-1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64avcodec53-0.10.15-1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64avfilter2-0.10.15-1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64avformat53-0.10.15-1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64avutil51-0.10.15-1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64ffmpeg-devel-0.10.15-1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64ffmpeg-static-devel-0.10.15-1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64postproc52-0.10.15-1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64swresample0-0.10.15-1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64swscaler2-0.10.15-1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/

FFmpeg Prior to 2.1 Multiple Remote Vulnerabilities

References:

• avcodec/dsputil: fix signedness in sizeof() comparissions (FFmpeg)
  
• avcodec/flashsv: check diff_start/height (FFmpeg)
  
• avcodec/g2meet: Fix framebuf size (FFmpeg)
  
• avcodec/g2meet: Fix order of align and pixel size multiplication. (FFmpeg)
  
• avcodec/h264: do not trust last_pic_droppable when marking pictures (FFmpeg)
  
• avcodec/jpeg2000dec: Check cdx/y values more carefully (FFmpeg)
  
• avcodec/jpeg2000dec: fix context consistency with too large lowres (FFmpeg)
  
• avcodec/jpeg2000dec: non zero image offsets are not supported (FFmpeg)
  
• avcodec/jpeg2000dec: prevent out of array accesses in pixel addressing (FFmpeg)
  
• avcodec/parser: reset indexes on realloc failure (FFmpeg)
  
• avcodec/pngdsp: fix (un)signed type in end comparission (FFmpeg)
  
• avcodec/rpza: Perform pointer advance and checks before (FFmpeg)
  
• avfilter/vf_fps: make sure the fifo is not empty before using it (FFmpeg)
  
• FFmpeg Homepage (FFmpeg )
  
• FFmpeg Multiple Vulnerabilities 0.10 Release Notes (FFmpeg)
  
• ffv1dec: Check bits_per_raw_sample and colorspace for equality (FFmpeg)
  
• ffv1dec: check that global parameters dont change in version 0/1 (FFmpeg)
  
• jpeg2000: check log2_cblk dimensions (FFmpeg)
  
• jpeg2000: fix dereferencing invalid pointers (FFmpeg)