A vulnerability was found in FFmpeg 2.0 (Multimedia Processing Software). It has been classified as problematic. Affected is the function shorten_decode_frame of the component Bitstream Buffer. The manipulation with an unknown input leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on availability.

The issue has been introduced in 07/11/2013. The weakness was published 02/06/2014 as shorten: pad the internal bitstream buffer as confirmed git commit (GIT Repository). The advisory is shared for download at git.videolan.org. This vulnerability is traded as CVE-2014-125022. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available.

The vulnerability was handled as a non-public zero-day exploit for at least 210 days. During that time the estimated underground price was around $0-$5k.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at git.videolan.org. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the databases at X-Force (91080) and Secunia (SA56838†). Similar entries are available at VDB-12293, VDB-12294, VDB-12295 and VDB-12296. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Multimedia Processing Software

Name

• FFmpeg

Version

• 2.0

License

• open-source

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion