A vulnerability was found in libav 12.3 (Multimedia Player Software) and classified as problematic. Affected by this issue is the function vc1_decode_frame of the file libavcodec/vc1dec.c of the component libavcodec. The manipulation as part of a ACC File leads to a memory corruption vulnerability. Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. Impacted is availability. CVE summarizes:

In Libav 12.3, there is an invalid memory access in vc1_decode_frame in libavcodec/vc1dec.c that allows attackers to cause a denial-of-service via a crafted aac file.

The bug was discovered 11/08/2018. The weakness was released 11/09/2018 (Website). The advisory is available at bugzilla.libav.org. This vulnerability is handled as CVE-2018-19130 since 11/09/2018. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit.

The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Entry connected to this vulnerability is available at 126625.

Productinfo

Type

• Multimedia Player Software

Name

• libav

Version

• 12.3

License

• open-source

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion