Buffer overflow in Ffmpeg

CVE-2012-0859

The render_line function in the vorbis codec (vorbis.c) in libavcodec in FFmpeg before 0.9.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted Vorbis file, related to a large multiplier. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3893.

Vulnerability class: Buffer Overflow

EPSS: 0.040 (89.4th percentile) — read the EPSS interpretation.

Affected products

  • Ffmpeg — versions 0.7.1, 0.7.2, 0.7.7
  • N/a — versions n/a

Weakness classification (CWE)

References