CVE-2013-0894

EUVD-2013-0905

23.02.2013, 21:55

Buffer overflow in the vorbis_parse_setup_hdr_floors function in the Vorbis decoder in vorbisdec.c in libavcodec in FFmpeg through 1.1.3, as used in Google Chrome before 25.0.1364.97 on Windows and Linux and before 25.0.1364.99 on Mac OS X and other products, allows remote attackers to cause a denial of service (divide-by-zero error or out-of-bounds array access) or possibly have unspecified other impact via vectors involving a zero value for a bark map size.

Classic Buffer Overflow

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.5 UNKNOWN	NETWORK	LOW		AV:N/AC:L/Au:N/C:P/I:P/A:P

Base Score

CVSS 3.x

EPSS Score

Percentile: 64%

Affected Products (NVD)

Vendor	Product	Version
google	chrome	𝑥 < 25.0.1364.99
google	chrome	𝑥 < 25.0.1364.97
ffmpeg	ffmpeg	𝑥 ≤ 1.1.3
opensuse	opensuse	12.1
opensuse	opensuse	12.2
canonical	ubuntu_linux	12.04
canonical	ubuntu_linux	12.10

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

ffmpeg

bookworm	7:5.1.6-0+deb12u1 fixed
bookworm (security)	7:5.1.6-0+deb12u1 fixed
bullseye	7:4.3.7-0+deb11u1 fixed
bullseye (security)	7:4.3.8-0+deb11u1 fixed
sid	7:7.1-3 fixed
trixie	7:7.1-3 fixed

Ubuntu Releases

Ubuntu Product

Codename

chromium-browser

hardy	dne
lucid	Fixed 25.0.1364.160-0ubuntu0.10.04.1 released
oneiric	Fixed 25.0.1364.160-0ubuntu0.11.10.1 released
precise	Fixed 25.0.1364.160-0ubuntu0.12.04.1 released
quantal	Fixed 25.0.1364.160-0ubuntu0.12.10.1 released
raring	Fixed 25.0.1364.160-0ubuntu1 released

ffmpeg

hardy	ignored
lucid	ignored
oneiric	dne
precise	dne
quantal	dne
raring	dne

ffmpeg-extra

hardy	dne
lucid	ignored
oneiric	dne
precise	dne
quantal	dne
raring	dne

libav

hardy	dne
lucid	dne
oneiric	ignored
precise	Fixed 4:0.8.6-0ubuntu0.12.04.1 released
quantal	Fixed 6:0.8.6-0ubuntu0.12.10.1 released
raring	not-affected

libav-extra

hardy	dne
lucid	dne
oneiric	ignored
precise	Fixed 4:0.8.6ubuntu0.12.04.1 released
quantal	Fixed 6:0.8.6ubuntu0.12.10.1 released
raring	not-affected

Common Weakness Enumeration

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The program copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

References

http://git.chromium.org/gitweb/?p=chromium/deps/ffmpeg.git%3Ba=commit%3Bh=e1e70d9bb9852b7d099379afc95531a632a20ba5

http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=2c16bf2de07c68513072bf3cc96401d2c6291a3e

http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html

http://lists.opensuse.org/opensuse-updates/2013-03/msg00045.html