Vulnerability in Ffmpeg

CVE-2012-2775

Unspecified vulnerability in the read_var_block_data function in libavcodec/alsdec.c in FFmpeg before 0.11, and Libav 0.7.x before 0.7.7 and 0.8.x before 0.8.4, has unknown impact and attack vectors, related to a large order and an "out of array write in quant_cof."

EPSS: 0.032 (87.0th percentile) — read the EPSS interpretation.

Affected products

Ffmpeg — versions 0.3, 0.3.1, 0.3.2
Libav — versions 0.8, 0.8.1, 0.8.2
N/a — versions n/a

References

chrome-cve-admin@google.com (mailing-list, x_refsource_MLIST)
chrome-cve-admin@google.com (x_refsource_CONFIRM)
chrome-cve-admin@google.com (x_refsource_CONFIRM)
chrome-cve-admin@google.com (vdb-entry, x_refsource_BID)
chrome-cve-admin@google.com (vendor-advisory, x_refsource_MANDRIVA)
chrome-cve-admin@google.com (mailing-list, x_refsource_MLIST)
chrome-cve-admin@google.com (x_refsource_CONFIRM)
chrome-cve-admin@google.com (x_refsource_CONFIRM)
chrome-cve-admin@google.com (x_refsource_SECUNIA, third-party-advisory)
chrome-cve-admin@google.com (x_refsource_SECUNIA, third-party-advisory)