CVE-2013-2495

Publication date 9 March 2013

Last updated 24 July 2024

Ubuntu priority

The iff_read_header function in iff.c in libavformat in FFmpeg through 1.1.3 does not properly handle data sizes for Interchange File Format (IFF) data during operations involving a CMAP chunk or a video codec, which allows remote attackers to cause a denial of service (integer overflow, out-of-bounds array access, and application crash) or possibly have unspecified other impact via a crafted header.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
ffmpeg	13.04 raring	Not in release
	12.10 quantal	Not in release
	12.04 LTS precise	Not in release
	11.10 oneiric	Not in release
	10.04 LTS lucid	Ignored
	8.04 LTS hardy	Ignored end of life
ffmpeg-extra	13.04 raring	Not in release
	12.10 quantal	Not in release
	12.04 LTS precise	Not in release
	11.10 oneiric	Not in release
	10.04 LTS lucid	Ignored
	8.04 LTS hardy	Not in release
libav	13.04 raring	Not affected
	12.10 quantal	Fixed 6:0.8.6-0ubuntu0.12.10.1
	12.04 LTS precise	Fixed 4:0.8.6-0ubuntu0.12.04.1
	11.10 oneiric	Ignored
	10.04 LTS lucid	Not in release
	8.04 LTS hardy	Not in release
libav-extra	13.04 raring	Not affected
	12.10 quantal	Fixed 6:0.8.6ubuntu0.12.10.1
	12.04 LTS precise	Fixed 4:0.8.6ubuntu0.12.04.1
	11.10 oneiric	Ignored
	10.04 LTS lucid	Not in release
	8.04 LTS hardy	Not in release

Notes

mdeslaur

ffmpeg-extra in multiverse needs to have matching version libav-extra is built with tarball produced by libav package ignoring releases near EoL. New version not available from upstream.

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
libav	Upstream: http://git.libav.org/?p=libav.git;a=commit;h=36aad4f1cc707feb15f071260a99f239b6623a59

References

Related Ubuntu Security Notices (USN)