9.3
CVSSv2

CVE-2008-3162

Published: 14/07/2008 Updated: 30/10/2018
CVSS v2 Base Score: 9.3 | Impact Score: 10 | Exploitability Score: 8.6
VMScore: 935
Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Vulnerability Summary

Stack-based buffer overflow in the str_read_packet function in libavformat/psxstr.c in FFmpeg before r13993 allows remote malicious users to cause a denial of service (application crash) or execute arbitrary code via a crafted STR file that interleaves audio and video sectors.

Vulnerable Product Search on Vulmon Subscribe to Product

ffmpeg ffmpeg 0.4.2

ffmpeg ffmpeg 0.4.3

ffmpeg ffmpeg 0.3.2

ffmpeg ffmpeg 0.3.3

ffmpeg ffmpeg 0.4.6

ffmpeg ffmpeg 0.4.7

ffmpeg ffmpeg 0.3.4

ffmpeg ffmpeg 0.4.0

ffmpeg ffmpeg 0.4.8

ffmpeg ffmpeg 0.4.9

ffmpeg ffmpeg 0.3

ffmpeg ffmpeg 0.3.1

ffmpeg ffmpeg 0.4.4

ffmpeg ffmpeg 0.4.5

Vendor Advisories

Debian Bug report logs - #524799 ffmpeg-debian: CVE-2009-0385 integer signedness error Package: ffmpeg-debian; Maintainer for ffmpeg-debian is (unknown); Reported by: "Michael S Gilbert" <michaelsgilbert@gmailcom> Date: Mon, 20 Apr 2009 01:18:01 UTC Severity: important Tags: security Found in versions 0cvs20060823-1, ...
It was discovered that ffmpeg did not correctly handle STR file demuxing If a user were tricked into processing a malicious STR file, a remote attacker could execute arbitrary code with user privileges via applications linked against ffmpeg ...
Several vulnerabilities have been discovered in ffmpeg, a multimedia player, server and encoder The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-0385 It was discovered that watching a malformed 4X movie file could lead to the execution of arbitrary code CVE-2008-3162 It was discovered that using a craf ...

Exploits

source: wwwsecurityfocuscom/bid/30154/info The 'libavformat' library from FFmpeg is prone to a remote heap-based buffer-overflow vulnerability because of insufficient boundary checks when parsing STR data Remote attackers can exploit this issue by enticing victims into opening maliciously crafted STR files with an application that uses ...