CVE-2013-0894

23.02.2013, 21:55

Buffer overflow in the vorbis_parse_setup_hdr_floors function in the Vorbis decoder in vorbisdec.c in libavcodec in FFmpeg through 1.1.3, as used in Google Chrome before 25.0.1364.97 on Windows and Linux and before 25.0.1364.99 on Mac OS X and other products, allows remote attackers to cause a denial of service (divide-by-zero error or out-of-bounds array access) or possibly have unspecified other impact via vectors involving a zero value for a bark map size.

Classic Buffer Overflow

Severity

UNKNOWN

AV:N/AC:L/Au:N/C:P/I:P/A:P

Atk. Vector

NETWORK

Atk. Complexity

LOW

Base Score

CVSS 3.x

EPSS Score

Percentile: 77%

Vendor	Product	Version
google	chrome	𝑥 < 25.0.1364.99
google	chrome	𝑥 < 25.0.1364.97
ffmpeg	ffmpeg	𝑥 ≤ 1.1.3
opensuse	opensuse	12.1
opensuse	opensuse	12.2
canonical	ubuntu_linux	12.04
canonical	ubuntu_linux	12.10

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

ffmpeg

bullseye	7:4.3.7-0+deb11u1 fixed
bullseye (security)	7:4.3.8-0+deb11u1 fixed
bookworm	7:5.1.6-0+deb12u1 fixed
bookworm (security)	7:5.1.6-0+deb12u1 fixed
sid	7:7.1-3 fixed
trixie	7:7.1-3 fixed

Ubuntu Releases

Ubuntu Product

Codename

chromium-browser

raring	Fixed 25.0.1364.160-0ubuntu1 released
quantal	Fixed 25.0.1364.160-0ubuntu0.12.10.1 released
precise	Fixed 25.0.1364.160-0ubuntu0.12.04.1 released
oneiric	Fixed 25.0.1364.160-0ubuntu0.11.10.1 released
lucid	Fixed 25.0.1364.160-0ubuntu0.10.04.1 released
hardy	dne

ffmpeg

raring	dne
quantal	dne
precise	dne
oneiric	dne
lucid	ignored
hardy	ignored

ffmpeg-extra

raring	dne
quantal	dne
precise	dne
oneiric	dne
lucid	ignored
hardy	dne

libav

raring	not-affected
quantal	Fixed 6:0.8.6-0ubuntu0.12.10.1 released
precise	Fixed 4:0.8.6-0ubuntu0.12.04.1 released
oneiric	ignored
lucid	dne
hardy	dne

libav-extra

raring	not-affected
quantal	Fixed 6:0.8.6ubuntu0.12.10.1 released
precise	Fixed 4:0.8.6ubuntu0.12.04.1 released
oneiric	ignored
lucid	dne
hardy	dne

Common Weakness Enumeration

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The program copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

References

http://git.chromium.org/gitweb/?p=chromium/deps/ffmpeg.git%3Ba=commit%3Bh=e1e70d9bb9852b7d099379afc95531a632a20ba5

http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=2c16bf2de07c68513072bf3cc96401d2c6291a3e

http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html

http://lists.opensuse.org/opensuse-updates/2013-03/msg00045.html