CVE-2009-0385

Integer signedness error in the fourxm_read_header function in libavformat/4xm.c in FFmpeg before revision 16846 allows remote attackers to execute arbitrary code via a malformed 4X movie file with a large current_track value, which triggers a NULL pointer dereference.
References
Link Resource
http://svn.mplayerhq.hu/ffmpeg/trunk/libavformat/4xm.c?r1=16838&r2=16846&pathrev=16846 Broken Link
http://www.securityfocus.com/bid/33502 Third Party Advisory VDB Entry
http://svn.mplayerhq.hu/ffmpeg?view=rev&revision=16846 Broken Link
http://git.ffmpeg.org/?p=ffmpeg;a=commitdiff;h=72e715fb798f2cb79fd24a6d2eaeafb7c6eeda17 Permissions Required
http://www.trapkit.de/advisories/TKADV2009-004.txt Third Party Advisory
http://secunia.com/advisories/33711 Third Party Advisory
http://osvdb.org/51643 Broken Link
http://www.ubuntu.com/usn/USN-734-1 Third Party Advisory
http://secunia.com/advisories/34296 Third Party Advisory
http://security.gentoo.org/glsa/glsa-200903-33.xml Third Party Advisory
http://secunia.com/advisories/34385 Third Party Advisory
https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00215.html Third Party Advisory
http://secunia.com/advisories/34712 Third Party Advisory
https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00210.html Third Party Advisory
http://www.debian.org/security/2009/dsa-1781 Third Party Advisory
http://secunia.com/advisories/34905 Third Party Advisory
http://secunia.com/advisories/34845 Third Party Advisory
http://www.debian.org/security/2009/dsa-1782 Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2009:297 Third Party Advisory
http://www.vupen.com/english/advisories/2009/0277 Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/48330 Third Party Advisory VDB Entry
http://www.securityfocus.com/archive/1/500514/100/0/threaded Third Party Advisory VDB Entry
Advertisement

NeevaHost hosting service

Configurations

Configuration 1 (hide)

cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:7.10:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:o:fedoraproject:fedora:9:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:10:*:*:*:*:*:*:*

Information

Published : 2009-02-02 11:30

Updated : 2020-11-20 07:54


NVD link : CVE-2009-0385

Mitre link : CVE-2009-0385


JSON object : View

Advertisement

dedicated server usa

Products Affected

debian

  • debian_linux

canonical

  • ubuntu_linux

ffmpeg

  • ffmpeg

fedoraproject

  • fedora