CVE-2013-2495
FFmpeg < 1.1.3 - Denial of Service via IFF CMAP Chunk Handling
Title source: llmDescription
The iff_read_header function in iff.c in libavformat in FFmpeg through 1.1.3 does not properly handle data sizes for Interchange File Format (IFF) data during operations involving a CMAP chunk or a video codec, which allows remote attackers to cause a denial of service (integer overflow, out-of-bounds array access, and application crash) or possibly have unspecified other impact via a crafted header.
References (2)
Core 2
Core References
Patch x_refsource_confirm
http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=3dbc0ff9c3e6f6e0d08ea3d42cb33761bae084ba
Vendor Advisory vendor-advisory
x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-1790-1
Scores
EPSS
0.0062
EPSS Percentile
70.4%
Details
CWE
CWE-189
Status
published
Products (49)
ffmpeg/ffmpeg
0.3
ffmpeg/ffmpeg
0.3.1
ffmpeg/ffmpeg
0.3.2
ffmpeg/ffmpeg
0.3.3
ffmpeg/ffmpeg
0.3.4
ffmpeg/ffmpeg
0.4.0
ffmpeg/ffmpeg
0.4.2
ffmpeg/ffmpeg
0.4.3
ffmpeg/ffmpeg
0.4.4
ffmpeg/ffmpeg
0.4.5
... and 39 more
Published
Mar 09, 2013
Tracked Since
Feb 18, 2026