vorbis_dec.c in FFmpeg 0.5 uses an assignment operator when a comparison operator was intended, which might allow remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted file that modifies a loop counter and triggers a heap-based buffer overflow.
CVSS Details
- CVSS 3.1 Base Score: 8.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade ffmpeg | Jul 30, 2024 | Feb 10, 2010 |
| Ffmpeg | — | Upgrade to FFmpeg version 0.5.1 | Sep 29, 2017 | Feb 10, 2010 |
| Gentoo Linux | — | Upgrade media-video/ffmpeg. | Oct 30, 2017 | Feb 9, 2010 |
| Ubuntu | — | Upgrade libavformat52Upgrade libavformat1dUpgrade libavcodec52Upgrade libavcodec1dUpgrade libavcodec51 | Nov 8, 2024 | Feb 10, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub