A vulnerability was found in FFmpeg 2.0. It has been declared as problematic. Affected by this vulnerability is the function decode_frame of the file libavcodec/ansi.c. The manipulation leads to integer coercion error. The CWE definition for the vulnerability is CWE-192. The issue has been introduced in 07/11/2013. The weakness was released 02/16/2014 by Mateusz Jurczyk and Gynvael Coldwind (j00ru) with Google Security Team as avcodec/ansi: fix integer overflow as GIT Commit (GIT Repository). It is possible to read the advisory at git.videolan.org. This vulnerability is known as CVE-2014-125011. The attack can be launched remotely. Technical details are available. There is no exploit available. The pricing for an exploit might be around USD $0-$5k at the moment. The vulnerability was handled as a non-public zero-day exploit for at least 220 days. We expect the 0-day to have been worth approximately $0-$5k. The bugfix is ready for download at git.videolan.org. It is recommended to apply a patch to fix this issue. A possible mitigation has been published even before and not after the disclosure of the vulnerability. The vulnerability is also documented other vulnerability databases: SecurityFocus (BID 65671), X-Force (91256) and Secunia (SA57066).

44 more entries are not shown