CVE-2013-2496
Published: 9 March 2013
The msrle_decode_8_16_24_32 function in msrledec.c in libavcodec in FFmpeg through 1.1.3 does not properly determine certain end pointers, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via crafted Microsoft RLE data.
Notes
Author | Note |
---|---|
mdeslaur | ffmpeg-extra in multiverse needs to have matching version libav-extra is built with tarball produced by libav package ignoring releases near EoL. New version not available from upstream. |
Priority
Status
Package | Release | Status |
---|---|---|
ffmpeg Launchpad, Ubuntu, Debian |
hardy |
Ignored
(end of life)
|
lucid |
Ignored
|
|
oneiric |
Does not exist
|
|
precise |
Does not exist
|
|
quantal |
Does not exist
|
|
raring |
Does not exist
|
|
upstream |
Needs triage
|
|
ffmpeg-extra Launchpad, Ubuntu, Debian |
hardy |
Does not exist
|
lucid |
Ignored
|
|
oneiric |
Does not exist
|
|
precise |
Does not exist
|
|
quantal |
Does not exist
|
|
raring |
Does not exist
|
|
upstream |
Needs triage
|
|
libav Launchpad, Ubuntu, Debian |
hardy |
Does not exist
|
lucid |
Does not exist
|
|
oneiric |
Ignored
|
|
precise |
Released
(4:0.8.6-0ubuntu0.12.04.1)
|
|
quantal |
Released
(6:0.8.6-0ubuntu0.12.10.1)
|
|
raring |
Not vulnerable
(6:0.8.6-1ubuntu2)
|
|
upstream |
Released
(0.8.6)
|
|
Patches: upstream: http://git.libav.org/?p=libav.git;a=commit;h=327ff82bac3081d918dceb4931c77e25d0a1480d upstream: http://git.libav.org/?p=libav.git;a=commit;h=4160398e2a3e229e29dff03300aaf630e726a768 |
||
libav-extra Launchpad, Ubuntu, Debian |
hardy |
Does not exist
|
lucid |
Does not exist
|
|
upstream |
Released
(0.8.6)
|
|
oneiric |
Ignored
|
|
precise |
Released
(4:0.8.6ubuntu0.12.04.1)
|
|
quantal |
Released
(6:0.8.6ubuntu0.12.10.1)
|
|
raring |
Not vulnerable
(6:0.8.6ubuntu2)
|