A vulnerability was found in FFmpeg 2.0 (Multimedia Processing Software). It has been classified as problematic. Affected is an unknown function of the file libavcodec/dxtroy.c. The manipulation with an unknown input leads to a integer coercion vulnerability. CWE is classifying the issue as CWE-192. Integer coercion refers to a set of flaws pertaining to the type casting, extension, or truncation of primitive data types. This is going to have an impact on availability. The advisory summarizes:

Affected functions: dxtory_decode_v1_rgb(), dxtory_decode_v1_410(), dxtory_decode_v1_420() and xtory_decode_v1_444()

The issue has been introduced in 07/11/2013. The weakness was published 02/16/2014 by Mateusz Jurczyk and Gynvael Coldwind (j00ru) with Google Security Team as avcodec/dxtory: fix src size checks as confirmed git commit (GIT Repository). The advisory is available at git.videolan.org. This vulnerability is traded as CVE-2014-125012. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are known, but there is no available exploit.

The vulnerability was handled as a non-public zero-day exploit for at least 220 days. During that time the estimated underground price was around $0-$5k.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at git.videolan.org.

The vulnerability is also documented in the databases at X-Force (91255), SecurityFocus (BID 65671†) and Secunia (SA57066†). Similar entries are available at VDB-12389, VDB-12391, VDB-12392 and VDB-12393. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Multimedia Processing Software

Name

• FFmpeg

Version

• 2.0

License

• open-source

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion