VRDA Feed by JPCERT/CC
  Vulnerability Response Decision Assistance Feed : Information for vulnerability impact analysis
[ about VRDA Feed | JPCERT/CC



 
Vulnerability Analysis Result (Revision No : 1) [ Download XML
CVE-2010-3429
ffmpeg, libavcodec, mplayer: flicvideo.c in libavcodec 0.6 and earlier in FFmpeg...
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-3429

Original

flicvideo.c in libavcodec 0.6 and earlier in FFmpeg, as used in MPlayer and other products, allows remote attackers to execute arbitrary code via a crafted flic file, related to an "arbitrary offset dereference vulnerability."

Translation   (Show)





About This Analysis Information
Analysis Information Provider:
NIST NVD
First Published:
2010-09-30
Source Information Category:
Advisory, Alert
Last Updated:
2010-10-01




Affected Product Tags
cpe:/a:ffmpeg:ffmpeg:0.3
cpe:/a:ffmpeg:ffmpeg:0.3.1
cpe:/a:ffmpeg:ffmpeg:0.3.2
cpe:/a:ffmpeg:ffmpeg:0.3.3
cpe:/a:ffmpeg:ffmpeg:0.3.4
cpe:/a:ffmpeg:ffmpeg:0.4.0
cpe:/a:ffmpeg:ffmpeg:0.4.2
cpe:/a:ffmpeg:ffmpeg:0.4.3
cpe:/a:ffmpeg:ffmpeg:0.4.4
cpe:/a:ffmpeg:ffmpeg:0.4.5
cpe:/a:ffmpeg:ffmpeg:0.4.6
cpe:/a:ffmpeg:ffmpeg:0.4.7
cpe:/a:ffmpeg:ffmpeg:0.4.8
cpe:/a:ffmpeg:ffmpeg:0.4.9:pre1
cpe:/a:ffmpeg:ffmpeg:0.5
cpe:/a:ffmpeg:ffmpeg:0.6 and previous versions
cpe:/a:ffmpeg:libavcodec
cpe:/a:mplayerhq:mplayer:0.01
cpe:/a:mplayerhq:mplayer:0.02
cpe:/a:mplayerhq:mplayer:0.05
cpe:/a:mplayerhq:mplayer:0.06
cpe:/a:mplayerhq:mplayer:0.07
cpe:/a:mplayerhq:mplayer:0.08
cpe:/a:mplayerhq:mplayer:0.09
cpe:/a:mplayerhq:mplayer:0.09:pre3
cpe:/a:mplayerhq:mplayer:0.10
cpe:/a:mplayerhq:mplayer:0.10:pre1
cpe:/a:mplayerhq:mplayer:0.10:pre2
cpe:/a:mplayerhq:mplayer:0.10:pre3
cpe:/a:mplayerhq:mplayer:0.10:pre4
cpe:/a:mplayerhq:mplayer:0.10:pre5
cpe:/a:mplayerhq:mplayer:0.10:pre6
cpe:/a:mplayerhq:mplayer:0.10:pre7
cpe:/a:mplayerhq:mplayer:0.11:pre10
cpe:/a:mplayerhq:mplayer:0.11:pre11
cpe:/a:mplayerhq:mplayer:0.11:pre12
cpe:/a:mplayerhq:mplayer:0.11:pre13
cpe:/a:mplayerhq:mplayer:0.11:pre14
cpe:/a:mplayerhq:mplayer:0.11:pre15
cpe:/a:mplayerhq:mplayer:0.11:pre16
cpe:/a:mplayerhq:mplayer:0.11:pre17
cpe:/a:mplayerhq:mplayer:0.11:pre18
cpe:/a:mplayerhq:mplayer:0.11:pre19
cpe:/a:mplayerhq:mplayer:0.11:pre2
cpe:/a:mplayerhq:mplayer:0.11:pre20
cpe:/a:mplayerhq:mplayer:0.11:pre21
cpe:/a:mplayerhq:mplayer:0.11:pre22
cpe:/a:mplayerhq:mplayer:0.11:pre23
cpe:/a:mplayerhq:mplayer:0.11:pre24
cpe:/a:mplayerhq:mplayer:0.11:pre3
cpe:/a:mplayerhq:mplayer:0.11:pre4
cpe:/a:mplayerhq:mplayer:0.11:pre5
cpe:/a:mplayerhq:mplayer:0.11:pre6
cpe:/a:mplayerhq:mplayer:0.11:pre7
cpe:/a:mplayerhq:mplayer:0.11:pre8
cpe:/a:mplayerhq:mplayer:0.11:pre9
cpe:/a:mplayerhq:mplayer:0.17_idegcounter
cpe:/a:mplayerhq:mplayer:0.17a_idegcounter
cpe:/a:mplayerhq:mplayer:0.18:pre1
cpe:/a:mplayerhq:mplayer:0.18:pre2
cpe:/a:mplayerhq:mplayer:0.18:pre3
cpe:/a:mplayerhq:mplayer:0.18:pre4
cpe:/a:mplayerhq:mplayer:0.18:pre5
cpe:/a:mplayerhq:mplayer:0.50
cpe:/a:mplayerhq:mplayer:0.50:pre1
cpe:/a:mplayerhq:mplayer:0.50:pre2
cpe:/a:mplayerhq:mplayer:0.50:pre3
cpe:/a:mplayerhq:mplayer:0.60
cpe:/a:mplayerhq:mplayer:0.60:pre1
cpe:/a:mplayerhq:mplayer:0.60:pre2
cpe:/a:mplayerhq:mplayer:0.90
cpe:/a:mplayerhq:mplayer:0.90:pre1
cpe:/a:mplayerhq:mplayer:0.90:pre10
cpe:/a:mplayerhq:mplayer:0.90:pre2
cpe:/a:mplayerhq:mplayer:0.90:pre3
cpe:/a:mplayerhq:mplayer:0.90:pre4
cpe:/a:mplayerhq:mplayer:0.90:pre5
cpe:/a:mplayerhq:mplayer:0.90:pre6
cpe:/a:mplayerhq:mplayer:0.90:pre7
cpe:/a:mplayerhq:mplayer:0.90:pre8
cpe:/a:mplayerhq:mplayer:0.90:pre9
cpe:/a:mplayerhq:mplayer:0.90:rc1
cpe:/a:mplayerhq:mplayer:0.90:rc2
cpe:/a:mplayerhq:mplayer:0.90:rc3
cpe:/a:mplayerhq:mplayer:0.90:rc3-pre1
cpe:/a:mplayerhq:mplayer:0.90:rc3-pre2
cpe:/a:mplayerhq:mplayer:0.90:rc3-pre3
cpe:/a:mplayerhq:mplayer:0.90:rc4
cpe:/a:mplayerhq:mplayer:0.90:rc5
cpe:/a:mplayerhq:mplayer:0.91
cpe:/a:mplayerhq:mplayer:0.92
cpe:/a:mplayerhq:mplayer:0.92.1
cpe:/a:mplayerhq:mplayer:0.93
cpe:/a:mplayerhq:mplayer:1.0:pre1
cpe:/a:mplayerhq:mplayer:1.0:pre2
cpe:/a:mplayerhq:mplayer:1.0:pre3
cpe:/a:mplayerhq:mplayer:1.0:pre3try2
cpe:/a:mplayerhq:mplayer:1.0:pre4
cpe:/a:mplayerhq:mplayer:1.0:pre5
cpe:/a:mplayerhq:mplayer:1.0:pre5try2
cpe:/a:mplayerhq:mplayer:1.0:pre6
cpe:/a:mplayerhq:mplayer:1.0:pre6a
cpe:/a:mplayerhq:mplayer:1.0:pre7
cpe:/a:mplayerhq:mplayer:1.0:pre7try2
cpe:/a:mplayerhq:mplayer:1.0:pre8
cpe:/a:mplayerhq:mplayer:1.0:rc1
cpe:/a:mplayerhq:mplayer:1.0:rc2
cpe:/a:mplayerhq:mplayer:1.0:rc3 and previous versions
 


Vulnerability Analysis Results
[Access Vector]  [?]
Undefined [?]

Local [?]
Adjacent Network [?]
X Network [?]

[Access Complexit]  [?]
Undefined [?]

High [?]
X Medium [?]
Low [?]

[Authentication]  [?]
Undefined [?]

Multiple [?]
Single [?]
X None [?]

[Confidentiality Impact]  [?]
Undefined [?]

None [?]
X Partial [?]
Complete [?]

[Integrity Impact]  [?]
Undefined [?]

None [?]
X Partial [?]
Complete [?]

[Availability Impact]  [?]
Undefined [?]

None [?]
X Partial [?]
Complete [?]

Alternatives




References
BUGTRAQ 20100928 [oCERT-2010-004] FFmpeg/libavcodec arbitrary offset dereference




CONFIRM http://git.ffmpeg.org/?p=ffmpeg;a=commit;h=16c592155f117ccd7b86006c45aacc692a81c23b




CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=635775




MISC http://www.ocert.org/advisories/ocert-2010-004.html




MLIST [oss-security] 20100928 [oCERT-2010-004] FFmpeg/libavcodec arbitrary offset dereference




SECUNIA 41626




VUPEN ADV-2010-2517




VUPEN ADV-2010-2518




Vulnerability Type Code Injection (CWE-94)





Copyright © 2010 JPCERT/CC All Rights Reserved.