A vulnerability, which was classified as problematic, was found in FFmpeg 2.0 (Multimedia Processing Software). This affects the function decode_nal_unit of the component Slice Segment Handler. The manipulation with an unknown input leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on availability.

The issue has been introduced in 07/11/2013. The weakness was disclosed 02/06/2014 as hevc: check that the VCL NAL types are the same for all slice segments of a frame as confirmed git commit (GIT Repository). The advisory is shared at git.videolan.org. This vulnerability is uniquely identified as CVE-2014-125019. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available.

The vulnerability was handled as a non-public zero-day exploit for at least 210 days. During that time the estimated underground price was around $0-$5k.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at git.videolan.org. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the databases at X-Force (91077) and Secunia (SA56838†). The entries VDB-12293, VDB-12294, VDB-12295 and VDB-12296 are pretty similar.

Productinfo

Type

• Multimedia Processing Software

Name

• FFmpeg

Version

• 2.0

License

• open-source

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion