---------------------------------------------------------------------- Secunia is hiring! Find your next job here: http://secunia.com/company/jobs/ ---------------------------------------------------------------------- TITLE: FFmpeg Multiple Vulnerabilities SECUNIA ADVISORY ID: SA47383 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/47383/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=47383 RELEASE DATE: 2012-01-06 DISCUSS ADVISORY: http://secunia.com/advisories/47383/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/47383/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=47383 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: Multiple vulnerabilities have been reported in FFmpeg, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise a user's system. 1) Errors when processing MKV and Vorbis files can be exploited to cause an out-of-bounds read. For more information see vulnerability #3 in: SA46815 2) An error when processing Vorbis files can be exploited to cause a heap-based buffer overflow. For more information see vulnerability #5 in: SA46815 3) An error within the "process_audio_header_eacs()" function (libavformat/electronicarts.c) can be exploited to cause a division by zero via e.g. specially crafted TGV files. 4) An error within the "ff_pnm_decode_header()" function (libavcodec/pnm.c) can be exploited to cause a division by zero via e.g. specially crafted PAM files. 5) An error within the "decode_band_types()" function (libavcodec/aacdec.c) can be exploited to cause an infinite loop via e.g. specially crafted of PCM files. 6) An error within the "load_ipmovie_packet()" function (libavformat/ipmovie.c) can be exploited to cause a division by zero via e.g. specially crafted MVE files. 7) An error within the "decode_slice_thread()" function (libavcodec/proresdec2.c) can be exploited to cause a crash due to an out-of-bounds read via e.g. specially crafted MOV files. 8) Errors within the "mpeg1_decode_sequence()" and "vcr2_init_sequence()" functions (libavcodec/mpeg12.c) can be exploited to cause a crash via e.g. specially crafted MPEG2 TS files. 9) A NULL-pointer dereference error within the "parse_bintree()" function (libavcodec/indeo3.c) can be exploited to cause a crash via e.g. specially crafted MOV files. 10) An error within the "get_ur_golomb_jpegls()" function (libavcodec/golomb.h) can be exploited to cause an infinite loop via e.g. specially crafted AVI files. 11) A NULL-pointer dereference error within the "ff_ivi_output_plane()" function (libavcodec/ivi_common.c) can be exploited to cause a crash via e.g. specially crafted media files using the INDEO5 codec. 12) Errors within the handling of MVE files can be exploited to cause a crash due to excessive memory consumption. 13) A NULL-pointer dereference error within the "tm2_read_stream()" function (libavcodec/truemotion2.c) can be exploited to cause a crash via e.g. specially crafted AVI files. 14) An error within the "avi_read_idx1()" function (libavformat/avidec.c) can be exploited to cause an infinite loop via e.g. specially crafted AVI files. 15) An error within the "adpcm_decode_frame()" function (libavcodec/adpcm.c) can be exploited to cause a crash via e.g. specially crafted WVE files. 16) An error within the "rl2_read_header()" function (libavformat/rl2.c) can be exploited to cause a crash due to a floating point exception. 17) A NULL-pointer dereference error within the "avpriv_mpeg4audio_get_config()" function (libavcodec/mpeg4audio.c) can be exploited to cause a crash. 18) An error within the "decodeTonalComponents()" function (libavcodec/atrac3.c) can be exploited to cause a crash. 19) An error within the "avi_read_header()" function (libavformat/avidec.c) can be exploited to cause a crash due to memory consumption via specially crafted AVI files. 20) An error within the "txd_read_header()" function (libavformat/txd.c) can be exploited to cause a crash due to memory consumption via specially crafted TXD files. 21) Errors within the processing of THP files can be exploited to cause a crash due to memory consumption. 22) An error within the "avi_read_packet()" function (libavformat/avidec.c) can be exploited to cause an infinite loop via specially crafted packages. 23) An integer overflow error within the "ff_j2k_dwt_init()" function (libavcodec/j2k_dwt.c) can be exploited to cause a heap-based buffer overflow. 24) An error within the "smacker_read_packet()" function (libavformat/smacker.c) can be exploited to cause a crash due to memory consumption via specially crafted SMK files. 25) An error within the "transcode_video()" function (ffmpeg.c) can be exploited to cause a crash via e.g. specially crafted VC1 files. 26) A boundary error within the "smka_decode_frame()" function (libavcodec/smacker.c) can be exploited to cause a crash due to out-of-bounds reads via specially crafted SMK files. 27) An error within the "ff_mov_read_stsd_entries()" function (libavformat/mov.c) can be exploited to cause an infinite loop via specially crafted MOV files. 28) An error when decoding JPEG files in lowres mode can be exploited to cause a crash via specially crafted JPEG files. 29) An error within the "sbr_qmf_synthesis()" function (libavcodec/aacsbr.c) can be exploited to cause a memory corruption via specially crafted media files. 30) An error within the "ff_h264_decode_seq_parameter_set()" function (libavcodec/h264_ps.c) can be exploited to cause a crash via e.g. specially crafted H264 files. 31) An error within the "mtv_read_header()" function (libavformat/mtv.c) can be exploited to cause a floating point exception via specially crafted MTV files. 32) Various other errors can be exploited to e.g. cause crashes due to NULL-pointer dereferences, out-of-bounds reads, floating point exceptions, integer overflows, excessive memory consumption and invalid memory frees or cause infinite loops via specially crafted media files. SOLUTION: Update to version 0.9.1. PROVIDED AND/OR DISCOVERED BY: 1, 2) Originally reported in Google Chrome by Aki Helin, OUSPG. 3, 5-15) Reported in a bug report by Oana Stratulat 4, 28) Reported in a bug report by ami_stuff 17) The vendor credits Gautam Gupta 18) cosmin 19-25, 27, 29, 30, 21) Diana Elena Muscalu 26) The vendor credits Shitiz Garg 32) Disclosed in GIT commits. ORIGINAL ADVISORY: http://ffmpeg.org/trac/ffmpeg/ticket/793 http://ffmpeg.org/trac/ffmpeg/ticket/837 http://ffmpeg.org/trac/ffmpeg/ticket/789 http://ffmpeg.org/trac/ffmpeg/ticket/807 http://ffmpeg.org/trac/ffmpeg/ticket/812 http://ffmpeg.org/trac/ffmpeg/ticket/809 http://ffmpeg.org/trac/ffmpeg/ticket/804 http://ffmpeg.org/trac/ffmpeg/ticket/806 http://ffmpeg.org/trac/ffmpeg/ticket/803 http://ffmpeg.org/trac/ffmpeg/ticket/801 http://ffmpeg.org/trac/ffmpeg/ticket/800 http://ffmpeg.org/trac/ffmpeg/ticket/794 http://ffmpeg.org/trac/ffmpeg/ticket/788 http://ffmpeg.org/trac/ffmpeg/ticket/780 http://ffmpeg.org/trac/ffmpeg/ticket/771 http://ffmpeg.org/trac/ffmpeg/ticket/772 http://ffmpeg.org/trac/ffmpeg/ticket/774 http://ffmpeg.org/trac/ffmpeg/ticket/775 http://ffmpeg.org/trac/ffmpeg/ticket/776 http://ffmpeg.org/trac/ffmpeg/ticket/777 http://ffmpeg.org/trac/ffmpeg/ticket/770 http://ffmpeg.org/trac/ffmpeg/ticket/768 http://ffmpeg.org/trac/ffmpeg/ticket/754 http://ffmpeg.org/trac/ffmpeg/ticket/760 http://ffmpeg.org/trac/ffmpeg/ticket/761 http://ffmpeg.org/trac/ffmpeg/ticket/758 http://ffmpeg.org/trac/ffmpeg/ticket/755 OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------