CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS
Percentile
73.1%
The iff_read_header function in iff.c in libavformat in FFmpeg through
1.1.3 does not properly handle data sizes for Interchange File Format (IFF)
data during operations involving a CMAP chunk or a video codec, which
allows remote attackers to cause a denial of service (integer overflow,
out-of-bounds array access, and application crash) or possibly have
unspecified other impact via a crafted header.
Author | Note |
---|---|
mdeslaur | ffmpeg-extra in multiverse needs to have matching version libav-extra is built with tarball produced by libav package ignoring releases near EoL. New version not available from upstream. |