The ff_h264_decode_seq_parameter_set function in h264_ps.c in libavcodec in FFmpeg before 0.9.1 and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.6, and 0.8.x before 0.8.3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted H.264 file, related to the chroma_format_idc value.
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
| Link | Tags |
|---|---|
| http://ffmpeg.org/trac/ffmpeg/ticket/758 | vendor advisory |
| http://www.ubuntu.com/usn/USN-1479-1 | vendor advisory |
| http://www.openwall.com/lists/oss-security/2012/02/14/4 | mailing list |
| http://www.debian.org/security/2012/dsa-2494 | vendor advisory |
| http://libav.org/ | vendor advisory |
| http://www.mandriva.com/security/advisories?name=MDVSA-2013:079 | vendor advisory |
| http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=7fff64e00d886fde11d61958888c82b461cf99b9 | |
| http://ffmpeg.org/security.html | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/78933 | vdb entry |