CVE-2009-0385

Опубликовано: 02 фев. 2009

Источник: nvd

CVSS2: 9.3

EPSS Средний

Описание

Integer signedness error in the fourxm_read_header function in libavformat/4xm.c in FFmpeg before revision 16846 allows remote attackers to execute arbitrary code via a malformed 4X movie file with a large current_track value, which triggers a NULL pointer dereference.

Ссылки

http://git.ffmpeg.org/?p=ffmpeg%3Ba=commitdiff%3Bh=72e715fb798f2cb79fd24a6d2eaeafb7c6eeda17
http://osvdb.org/51643
Broken Link
http://secunia.com/advisories/33711
Third Party Advisory
http://secunia.com/advisories/34296
Third Party Advisory
http://secunia.com/advisories/34385
Third Party Advisory
http://secunia.com/advisories/34712
Third Party Advisory
http://secunia.com/advisories/34845
Third Party Advisory
http://secunia.com/advisories/34905
Third Party Advisory
http://security.gentoo.org/glsa/glsa-200903-33.xml
Third Party Advisory
http://svn.mplayerhq.hu/ffmpeg/trunk/libavformat/4xm.c?r1=16838&r2=16846&pathrev=16846
Broken Link
http://svn.mplayerhq.hu/ffmpeg?view=rev&revision=16846
Broken Link
http://www.debian.org/security/2009/dsa-1781
Third Party Advisory
http://www.debian.org/security/2009/dsa-1782
Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2009:297
Third Party Advisory
http://www.securityfocus.com/archive/1/500514/100/0/threaded
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/33502
Third Party Advisory
VDB Entry
http://www.trapkit.de/advisories/TKADV2009-004.txt
Third Party Advisory
http://www.ubuntu.com/usn/USN-734-1
Third Party Advisory
http://www.vupen.com/english/advisories/2009/0277
Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/48330
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*

Версия до 0.6.3 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:canonical:ubuntu_linux:7.10:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:o:fedoraproject:fedora:9:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:10:*:*:*:*:*:*:*

EPSS

Процентиль: 93%

0.11552

Средний

9.3 Critical

CVSS2

Дефекты

NVD-CWE-Other

Связанные уязвимости

CVE-2009-0385

ubuntu

почти 17 лет назад

CVE-2009-0385

debian

почти 17 лет назад

Integer signedness error in the fourxm_read_header function in libavfo ...

GHSA-h3wc-jxm7-mr49

github

больше 3 лет назад

BDU:2015-02204

fstec

больше 17 лет назад

Уязвимости операционной системы Debian GNU/Linux, позволяющие удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации

EPSS

Процентиль: 93%

0.11552

Средний

9.3 Critical

CVSS2

Дефекты

NVD-CWE-Other