CVE-2013-0848
The decode_init function in libavcodec/huffyuv.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via a crafted width in huffyuv data with the predictor set to median and the colorspace set to YUV422P, which triggers an…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.45%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The decode_init function in libavcodec/huffyuv.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via a crafted width in huffyuv data with the predictor set to median and the colorspace set to YUV422P, which triggers an out-of-bounds array access.
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 2.45% probability · 83th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- ffmpeg/ffmpeg
- Source
- chrome-cve-admin@google.com
References
- http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=6abb9a901fca27da14d4fffbb01948288b5da3ba
- http://www.ffmpeg.org/security.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2014:227
- http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=6abb9a901fca27da14d4fffbb01948288b5da3ba
- http://www.ffmpeg.org/security.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2014:227
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.