deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-6409
Published: 2013-12-07
Description: Debian adequate before 0.8.1, when run by root with the --user option, allows local users to hijack the tty and possibly gain privileges via the TIOCSTI ioctl.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-264
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=730691; http://www.securityfocus.com/bid/63994; https://bitbucket.org/jwilk/adequate/raw/tip/debian/changelog
CVE: CVE-2013-6410
Published: 2013-12-07
Description: nbd-server in Network Block Device (nbd) before 3.5 does not properly check IP addresses, which might allow remote attackers to bypass intended access restrictions via an IP address that has a partial match in the authfile configuration file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://sourceforge.net/mailarchive/forum.php?thread_name=529BAA58.2080401%40uter.be&forum_name=nbd-general; http://www.debian.org/security/2013/dsa-2806; http://www.openwall.com/lists/oss-security/2013/11/29/4
CVE: CVE-2012-6612
Published: 2013-12-07
Description: The (1) UpdateRequestHandler for XSLT or (2) XPathEntityProcessor in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, different vectors than CVE-2013-6407.
CVSS Score: 7.5 (HIGH)
References: http://rhn.redhat.com/errata/RHSA-2013-1844.html; http://rhn.redhat.com/errata/RHSA-2014-0029.html; http://svn.apache.org/viewvc/lucene/dev/branches/branch_4x/solr/CHANGES.txt?view=markup
CVE: CVE-2013-0844
Published: 2013-12-07
Description: Off-by-one error in the adpcm_decode_frame function in libavcodec/adpcm.c in FFmpeg before 1.0.4 allows remote attackers to have an unspecified impact via crafted DK4 data, which triggers an out-of-bounds array access.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=85a14dbd5dca34320f58b1ba11dd6dd0df4fb3be; http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=f18c873ab5ee3c78d00fdcc2582b39c133faecb4; http://www.debian.org/security/2013/dsa-2793
CVE: CVE-2013-0845
Published: 2013-12-07
Description: libavcodec/alsdec.c in FFmpeg before 1.0.4 allows remote attackers to have an unspecified impact via a crafted block length, which triggers an out-of-bounds write.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=0ceca269b66ec12a23bf0907bd2c220513cdbf16; http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=6df0d3e2916c223dbe4262bf1b876dff1cb3f980; http://www.debian.org/security/2014/dsa-2855
CVE: CVE-2013-0846
Published: 2013-12-07
Description: Array index error in the qdm2_decode_super_block function in libavcodec/qdm2.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via crafted QDM2 data, which triggers an out-of-bounds array access.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=a7ee6281f7ef1c29284e3a4cadfe0f227ffde1ed; http://www.debian.org/security/2014/dsa-2855; http://www.ffmpeg.org/security.html
CVE: CVE-2013-0847
Published: 2013-12-07
Description: The ff_id3v2_parse function in libavformat/id3v2.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via ID3v2 header data, which triggers an out-of-bounds array access.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=10416a4d56fa8a89784e4fb62099c3cab17a9952; http://www.ffmpeg.org/security.html; http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=10416a4d56fa8a89784e4fb62099c3cab17a9952
CVE: CVE-2013-0848
Published: 2013-12-07
Description: The decode_init function in libavcodec/huffyuv.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via a crafted width in huffyuv data with the predictor set to median and the colorspace set to YUV422P, which triggers an out-of-bounds array access.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=6abb9a901fca27da14d4fffbb01948288b5da3ba; http://www.ffmpeg.org/security.html; http://www.mandriva.com/security/advisories?name=MDVSA-2014:227
CVE: CVE-2013-0849
Published: 2013-12-07
Description: The roq_decode_init function in libavcodec/roqvideodec.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via a crafted (1) width or (2) height dimension that is not a multiple of sixteen in id RoQ video data.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=3ae610451170cd5a28b33950006ff0bd23036845; http://www.debian.org/security/2014/dsa-2855; http://www.ffmpeg.org/security.html
CVE: CVE-2013-0850
Published: 2013-12-07
Description: The decode_slice_header function in libavcodec/h264.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via crafted H.264 data, which triggers an out-of-bounds array access.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=d6c184880ee2e09fd68c0ae217173832cee5afc1; http://www.debian.org/security/2013/dsa-2793; http://www.ffmpeg.org/security.html
CVE: CVE-2013-0851
Published: 2013-12-07
Description: The decode_frame function in libavcodec/eamad.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via crafted Electronic Arts Madcow video data, which triggers an out-of-bounds array access.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=63ac64864c6e0e84355aa3caa5b92208997a9a8d; http://www.ffmpeg.org/security.html; http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=63ac64864c6e0e84355aa3caa5b92208997a9a8d
CVE: CVE-2013-0852
Published: 2013-12-07
Description: The parse_picture_segment function in libavcodec/pgssubdec.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via crafted RLE data, which triggers an out-of-bounds array access.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=c0d68be555f[PII_REDACTED]040e04fcd[PII_REDACTED]; http://www.ffmpeg.org/security.html; http://www.mandriva.com/security/advisories?name=MDVSA-2014:227
CVE: CVE-2013-0853
Published: 2013-12-07
Description: The wavpack_decode_frame function in libavcodec/wavpack.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via crafted WavPack data, which triggers an out-of-bounds array access, possibly due to an off-by-one error.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=be818df547c3b0ae4fadb50fd210139a8636706a; http://www.debian.org/security/2013/dsa-2793; http://www.ffmpeg.org/security.html
CVE: CVE-2013-0854
Published: 2013-12-07
Description: The mjpeg_decode_scan_progressive_ac function in libavcodec/mjpegdec.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via crafted MJPEG data.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=1f41cffe1e3e79620f587545bdfcbd7e6e68ed29; http://www.debian.org/security/2013/dsa-2793; http://www.ffmpeg.org/security.html
CVE: CVE-2013-0855
Published: 2013-12-07
Description: Integer overflow in the alac_decode_close function in libavcodec/alac.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via a large number of samples per frame in Apple Lossless Audio Codec (ALAC) data, which triggers an out-of-bounds array access.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=3920d1387834e2bc334aff9f518f4beb24e470bd; http://www.ffmpeg.org/security.html; http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=3920d1387834e2bc334aff9f518f4beb24e470bd
CVE: CVE-2013-0856
Published: 2013-12-07
Description: The lpc_prediction function in libavcodec/alac.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via crafted Apple Lossless Audio Codec (ALAC) data, related to a large nb_samples value.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=fd4f4923cce6a2cbf4f48640b4ac706e614a1594; http://www.ffmpeg.org/security.html; http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=fd4f4923cce6a2cbf4f48640b4ac706e614a1594
CVE: CVE-2013-0857
Published: 2013-12-07
Description: The decode_frame_ilbm function in libavcodec/iff.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via a crafted height value in IFF PBM/ILBM bitmap data.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=2fbb37b51bbea891392ad357baf8f3dff00bac05; http://www.debian.org/security/2013/dsa-2793; http://www.ffmpeg.org/security.html
CVE: CVE-2013-0858
Published: 2013-12-07
Description: The atrac3_decode_init function in libavcodec/atrac3.c in FFmpeg before 1.0.4 allows remote attackers to have an unspecified impact via ATRAC3 data with the joint stereo coding mode set and fewer than two channels.
CVSS Score: 9.3 (HIGH)
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=13451f5520ce6b0afde861b2285dda659f8d4fb4; http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=2502914c5f8eb77659d7c[PII_REDACTED]557a63245; http://www.debian.org/security/2013/dsa-2793
CVE: CVE-2013-0859
Published: 2013-12-07
Description: The add_doubles_metadata function in libavcodec/tiff.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via a negative or zero count value in a TIFF image, which triggers an out-of-bounds array access.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=6d1c5ea04af3e345232aa70c944de961061dab2d; http://www.ffmpeg.org/security.html; http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=6d1c5ea04af3e345232aa70c944de961061dab2d
CVE: CVE-2013-6385
Published: 2013-12-07
Description: The form API in Drupal 6.x before 6.29 and 7.x before 7.24, when used with unspecified third-party modules, performs form validation even when CSRF validation has failed, which might allow remote attackers to trigger application-specific impacts such as arbitrary code execution via application-specific vectors.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/56148; http://www.debian.org/security/2013/dsa-2804; http://www.debian.org/security/2013/dsa-2828
CVE: CVE-2013-6386
Published: 2013-12-07
Description: Drupal 6.x before 6.29 and 7.x before 7.24 uses the PHP mt_rand function to generate random numbers, which uses predictable seeds and allows remote attackers to predict security strings and bypass intended restrictions via a brute force attack.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-310
References: http://secunia.com/advisories/56148; http://www.debian.org/security/2013/dsa-2804; http://www.debian.org/security/2013/dsa-2828
CVE: CVE-2013-6389
Published: 2013-12-07
Description: Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.24 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.debian.org/security/2013/dsa-2804; http://www.openwall.com/lists/oss-security/2013/11/22/4; https://drupal.org/SA-CORE-2013-003
CVE: CVE-2013-7000
Published: 2013-12-07
Description: The Multimedia Messaging Centre (MMSC) in NowSMS Now SMS & MMS Gateway 2013.09.26 allows remote attackers to cause a denial of service via a malformed message to a MM4 connection.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/55805; http://www.nowsms.com/nowsms20131115; http://www.securityfocus.com/bid/63879
CVE: CVE-2013-7001
Published: 2013-12-07
Description: The Multimedia Messaging Centre (MMSC) in NowSMS Now SMS & MMS Gateway before 2013.11.15 allows remote attackers to cause a denial of service via a malformed MM1 message that is routed to a (1) MM4 or (2) MM7 connection.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/55805; http://www.nowsms.com/nowsms20131115; http://www.securityfocus.com/bid/63879
CVE: CVE-2013-6406
Published: 2013-12-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-6858. Reason: This candidate is a reservation duplicate of CVE-2013-6858. Notes: All CVE users should reference CVE-2013-6858 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2011-3934
Published: 2013-12-09
Description: Double free vulnerability in the vp3_update_thread_context function in libavcodec/vp3.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact via crafted vp3 data.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=247d30a7dba6684ccce4508424f35fd58465e535; http://www.ffmpeg.org/security.html; http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=247d30a7dba6684ccce4508424f35fd58465e535
CVE: CVE-2011-3935
Published: 2013-12-09
Description: The codec_get_buffer function in ffmpeg.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact via vectors related to a crafted image size.
CVSS Score: 6.8 (MEDIUM)
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=668494acd8b20f974c7722895d4a6a14c1005f1e; http://www.ffmpeg.org/security.html; http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=668494acd8b20f974c7722895d4a6a14c1005f1e
CVE: CVE-2011-3941
Published: 2013-12-09
Description: The decode_mb function in libavcodec/error_resilience.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact via vectors related to an uninitialized block index, which triggers an out-of-bounds write.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=c77be3a35a0160d6af88056b0899f120f2eef38e; http://www.ffmpeg.org/security.html; http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=c77be3a35a0160d6af88056b0899f120f2eef38e
CVE: CVE-2011-3944
Published: 2013-12-09
Description: The smacker_decode_header_tree function in libavcodec/smacker.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact via crafted Smacker data.
CVSS Score: 6.8 (MEDIUM)
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=1285baaab550e3e761590ef6dfb1d9bd9d1332e4; http://www.debian.org/security/2014/dsa-2855; http://www.ffmpeg.org/security.html
CVE: CVE-2011-3946
Published: 2013-12-09
Description: The ff_h264_decode_sei function in libavcodec/h264_sei.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact via crafted Supplemental enhancement information (SEI) data, which triggers an infinite loop.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=9decfc17bb76da[PII_REDACTED]8d390b176abf404c; http://www.ffmpeg.org/security.html; http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=9decfc17bb76da[PII_REDACTED]8d390b176abf404c
CVE: CVE-2011-3949
Published: 2013-12-09
Description: The dirac_unpack_idwt_params function in libavcodec/diracdec.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact via crafted Dirac data.
CVSS Score: 6.8 (MEDIUM)
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=e2291ea1534d17306f685b8c8abc8585bbed87bf; http://www.ffmpeg.org/security.html; http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=e2291ea1534d17306f685b8c8abc8585bbed87bf
CVE: CVE-2011-3950
Published: 2013-12-09
Description: The dirac_decode_data_unit function in libavcodec/diracdec.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact via a crafted value in the reference pictures number.
CVSS Score: 6.8 (MEDIUM)
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=ddf0c1d86ad8e1df5ab3265206aef493a1bdc813; http://www.ffmpeg.org/security.html; http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=ddf0c1d86ad8e1df5ab3265206aef493a1bdc813
CVE: CVE-2011-4351
Published: 2013-12-09
Description: Buffer overflow in FFmpeg before 0.5.6, 0.6.x before 0.6.4, 0.7.x before 0.7.8, and 0.8.x before 0.8.8 allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://seclists.org/bugtraq/2011/Nov/145; http://www.ffmpeg.org/security.html; http://seclists.org/bugtraq/2011/Nov/145
CVE: CVE-2013-1349
Published: 2013-12-09
Description: Eval injection vulnerability in ajax.php in openSIS 4.5 through 5.2 allows remote attackers to execute arbitrary PHP code via the modname parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://karmainsecurity.com/KIS-2013-10; http://secunia.com/advisories/55913; http://sourceforge.net/p/opensis-ce/bugs/59/
CVE: CVE-2013-1953
Published: 2013-12-09
Description: Integer underflow in the input_bmp_reader function in input-bmp.c in AutoTrace 0.31.1 allows context-dependent attackers to have an unspecified impact via a small value in the biSize field in the header of a BMP file, which triggers a buffer overflow.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://www.mandriva.com/security/advisories?name=MDVSA-2013:190; http://www.openwall.com/lists/oss-security/2013/04/16/3; https://bugzilla.redhat.com/show_bug.cgi?id=951257
CVE: CVE-2013-4376
Published: 2013-12-09
Description: The setgid wrapper libx2go-server-db-sqlite3-wrapper.c in X2Go Server before 4.0.0.2 allows remote attackers to execute arbitrary code via unspecified vectors, related to the path to libx2go-server-db-sqlite3-wrapper.pl.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://code.x2go.org/gitweb?p=x2goserver.git%3Ba=commit%3Bh=42264c88d7885474ebe3763b2991681ddfcfa69a; http://security.gentoo.org/glsa/glsa-201310-19.xml; http://www.openwall.com/lists/oss-security/2013/09/25/11
CVE: CVE-2013-4400
Published: 2013-12-09
Description: virt-login-shell in libvirt 1.1.2 through 1.1.3 allows local users to overwrite arbitrary files and possibly gain privileges via unspecified environment variables or command-line arguments.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=3e2f27e13b94f7302ad948bcacb5e02c859a25fc; http://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=8c3586ea755c40d5e01b22cb7b5c1e668cdec994; http://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=b7fcc799ad5d8f3e55b89b94e599903e3c092467
CVE: CVE-2013-6171
Published: 2013-12-09
Description: checkpassword-reply in Dovecot before 2.2.7 performs setuid operations to a user who is authenticating, which allows local users to bypass authentication and access virtual email accounts by attaching to the process and using a restricted file descriptor to modify account information in the response to the dovecot-auth server.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-287
References: http://cpanel.net/tsr-2013-0010-full-disclosure/; http://secunia.com/advisories/54808; http://wiki2.dovecot.org/AuthDatabase/CheckPassword#Security
CVE: CVE-2013-6404
Published: 2013-12-09
Description: Quassel core (server daemon) in Quassel IRC before 0.9.2 does not properly verify the user ID when accessing user backlogs, which allows remote authenticated users to read other users' backlogs via the bufferid in (1) 16/select_buffer_by_id.sql, (2) 16/select_buffer_by_id.sql, and (3) 16/select_buffer_by_id.sql in core/SQL/PostgreSQL/.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-updates/2013-12/msg00092.html; http://lists.opensuse.org/opensuse-updates/2014-01/msg00078.html; http://osvdb.org/100432
CVE: CVE-2013-7008
Published: 2013-12-09
Description: The decode_slice_header function in libavcodec/h264.c in FFmpeg before 2.1 incorrectly relies on a certain droppable field, which allows remote attackers to cause a denial of service (deadlock) or possibly have unspecified other impact via crafted H.264 data.
CVSS Score: 6.8 (MEDIUM)
References: http://ffmpeg.org/security.html; http://openwall.com/lists/oss-security/2013/11/26/7; http://openwall.com/lists/oss-security/2013/12/08/3
CVE: CVE-2013-7009
Published: 2013-12-09
Description: The rpza_decode_stream function in libavcodec/rpza.c in FFmpeg before 2.1 does not properly maintain a pointer to pixel data, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Apple RPZA data.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://ffmpeg.org/security.html; http://openwall.com/lists/oss-security/2013/11/26/7; http://openwall.com/lists/oss-security/2013/12/08/3
CVE: CVE-2013-7010
Published: 2013-12-09
Description: Multiple integer signedness errors in libavcodec/dsputil.c in FFmpeg before 2.1 allow remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted data.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://ffmpeg.org/security.html; http://git.libav.org/?p=libav.git%3Ba=blob%3Bf=Changelog%3Bhb=refs/tags/v9.11; http://openwall.com/lists/oss-security/2013/11/26/7
CVE: CVE-2013-7011
Published: 2013-12-09
Description: The read_header function in libavcodec/ffv1dec.c in FFmpeg before 2.1 does not prevent changes to global parameters, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted FFV1 data.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://ffmpeg.org/security.html; http://openwall.com/lists/oss-security/2013/11/26/7; http://openwall.com/lists/oss-security/2013/12/08/3
CVE: CVE-2013-7012
Published: 2013-12-09
Description: The get_siz function in libavcodec/jpeg2000dec.c in FFmpeg before 2.1 does not prevent attempts to use non-zero image offsets, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG2000 data.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://ffmpeg.org/security.html; http://openwall.com/lists/oss-security/2013/11/26/7; http://openwall.com/lists/oss-security/2013/12/08/3
CVE: CVE-2013-7013
Published: 2013-12-09
Description: The g2m_init_buffers function in libavcodec/g2meet.c in FFmpeg before 2.1 uses an incorrect ordering of arithmetic operations, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Go2Webinar data.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://ffmpeg.org/security.html; http://openwall.com/lists/oss-security/2013/11/26/7; http://openwall.com/lists/oss-security/2013/12/08/3
CVE: CVE-2013-7014
Published: 2013-12-09
Description: Integer signedness error in the add_bytes_l2_c function in libavcodec/pngdsp.c in FFmpeg before 2.1 allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted PNG data.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://ffmpeg.org/security.html; http://git.libav.org/?p=libav.git%3Ba=blob%3Bf=Changelog%3Bhb=refs/tags/v9.11; http://openwall.com/lists/oss-security/2013/11/26/7
CVE: CVE-2013-7015
Published: 2013-12-09
Description: The flashsv_decode_frame function in libavcodec/flashsv.c in FFmpeg before 2.1 does not properly validate a certain height value, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Flash Screen Video data.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://ffmpeg.org/security.html; http://openwall.com/lists/oss-security/2013/11/26/7; http://openwall.com/lists/oss-security/2013/12/08/3