CVE-2009-4636 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	4.3 UNKNOWN	NETWORK	MEDIUM		AV:N/AC:M/Au:N/C:N/I:N/A:P

Base Score

CVSS 3.x

EPSS Score

Percentile: 86%

Affected Products (NVD)

Vendor	Product	Version
ffmpeg	ffmpeg	0.5

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

ffmpeg

bookworm	7:5.1.6-0+deb12u1 fixed
bookworm (security)	7:5.1.6-0+deb12u1 fixed
bullseye	7:4.3.7-0+deb11u1 fixed
bullseye (security)	7:4.3.8-0+deb11u1 fixed
sid	7:7.1-3 fixed
trixie	7:7.1-3 fixed

Ubuntu Releases

Ubuntu Product

Codename

ffmpeg

dapper	ignored
hardy	ignored
intrepid	ignored
jaunty	ignored
karmic	ignored

ffmpeg-debian

dapper	dne
hardy	dne
intrepid	ignored
jaunty	ignored
karmic	dne

Known Exploits!

Common Weakness Enumeration

CWE-94 - Improper Control of Generation of Code ('Code Injection')
The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References

http://scarybeastsecurity.blogspot.com/2009/09/patching-ffmpeg-into-shape.html

http://secunia.com/advisories/36805

http://secunia.com/advisories/38643

http://www.debian.org/security/2010/dsa-2000

http://www.mandriva.com/security/advisories?name=MDVSA-2011:061

http://www.mandriva.com/security/advisories?name=MDVSA-2011:062

http://www.mandriva.com/security/advisories?name=MDVSA-2011:088

http://www.mandriva.com/security/advisories?name=MDVSA-2011:089

http://www.mandriva.com/security/advisories?name=MDVSA-2011:112

http://www.mandriva.com/security/advisories?name=MDVSA-2011:114

http://www.securityfocus.com/bid/36465

http://www.vupen.com/english/advisories/2011/1241

https://roundup.ffmpeg.org/roundup/ffmpeg/issue1240

http://scarybeastsecurity.blogspot.com/2009/09/patching-ffmpeg-into-shape.html

http://secunia.com/advisories/36805

http://secunia.com/advisories/38643

http://www.debian.org/security/2010/dsa-2000

http://www.mandriva.com/security/advisories?name=MDVSA-2011:061

http://www.mandriva.com/security/advisories?name=MDVSA-2011:062

http://www.mandriva.com/security/advisories?name=MDVSA-2011:088

http://www.mandriva.com/security/advisories?name=MDVSA-2011:089

http://www.mandriva.com/security/advisories?name=MDVSA-2011:112

http://www.mandriva.com/security/advisories?name=MDVSA-2011:114

http://www.securityfocus.com/bid/36465

http://www.vupen.com/english/advisories/2011/1241

https://roundup.ffmpeg.org/roundup/ffmpeg/issue1240