Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

CVE-2012-0851

Published: 14 February 2012

The ff_h264_decode_seq_parameter_set function in h264_ps.c in libavcodec in FFmpeg before 0.9.1 and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.6, and 0.8.x before 0.8.3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted H.264 file, related to the chroma_format_idc value.

Notes

AuthorNote
mdeslaur
in ffmpeg 0.5.x, issue is in h264.c
as of 2012-05-22, no fix in ffmpeg 0.5.x

Priority

Low

Status

Package Release Status
libav
Launchpad, Ubuntu, Debian
hardy Does not exist

lucid Does not exist

maverick Does not exist

natty
Released (4:0.6.6-0ubuntu0.11.04.1)
oneiric
Released (4:0.7.6-0ubuntu0.11.10.1)
precise
Released (4:0.8.3-0ubuntu0.12.04.1)
upstream
Released (0.6.6,0.7.6,0.8.3)
Patches:
upstream: http://git.libav.org/?p=libav.git;a=commit;h=6ef4063957aa5025c8d2cd757b6a537e4b6874df
ffmpeg
Launchpad, Ubuntu, Debian
hardy Ignored
(end of life)
lucid
Released (4:0.5.9-0ubuntu0.10.04.1)
maverick Ignored
(end of life)
natty Does not exist

oneiric Does not exist

precise Does not exist

upstream Needs triage

ffmpeg-extra
Launchpad, Ubuntu, Debian
hardy Does not exist

lucid
Released
maverick Ignored
(end of life)
natty Does not exist

oneiric Does not exist

precise Does not exist

upstream Needs triage

libav-extra
Launchpad, Ubuntu, Debian
hardy Does not exist

lucid Does not exist

maverick Does not exist

natty
Released (4:0.6.6-0ubuntu0.11.04.1)
oneiric
Released (4:0.7.6-0ubuntu0.11.10.1)
precise
Released (4:0.8.3ubuntu0.12.04.1)
upstream Needs triage