CVE-2012-0851 — Vulnetix

Try Vulnetix Request Demo

CVE-2012-0851 PUBLISHED CVSS 6.800000190734863 MEDIUM

The ff_h264_decode_seq_parameter_set function in h264_ps.c in libavcodec in FFmpeg before 0.9.1 and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.6, and 0.8.x before 0.8.3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted H.264 file, related to the chroma_format_idc value.

EPSS 2.17% · 84.2th percentile

Risk Scores

CVSS v2.0

6.800000190734863

EPSS Score

2.17%

84.2th percentile

Affected Products

Vendor	Product	Versions
libav	libav	0.8.2, 0.6, 0.6.1
n/a	n/a	n/a
ffmpeg	ffmpeg	0.7.1, 0.7.2, 0.7.7

Timeline

Aug 20, 2012 CVE Published
Feb 4, 2022 EPSS Score
Mar 28, 2022 EPSS Score
May 19, 2022 EPSS Score
Jul 10, 2022 EPSS Score
Sep 1, 2022 EPSS Score
Dec 14, 2022 EPSS Score
Feb 4, 2023 EPSS Score
Mar 7, 2023 EPSS Score
Mar 28, 2023 EPSS Score
May 19, 2023 EPSS Score
Jul 10, 2023 EPSS Score

References

http://ffmpeg.org/trac/ffmpeg/ticket/758 url
USN-1479-1 vendor-advisory
[oss-security] 20120214 Re: CVE Requests for FFmpeg 0.9.1 mailing-list
DSA-2494 vendor-advisory
http://libav.org/ url
MDVSA-2013:079 vendor-advisory
http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=7fff64e00d886fde11d61958888c82b461cf99b9 url
http://ffmpeg.org/security.html url
ffmpeg-ffh264decode-code-exec(78933) vdb
https://nvd.nist.gov/vuln/detail/CVE-2012-0851 advisory
http://git.videolan.org/?p=ffmpeg.git;a=commit;h=7fff64e00d886fde11d61958888c82b461cf99b9 url
http://libav.org url

Open in Interactive Console →