CVE-2013-0860

qffmpeg: NULL pointer dereference in libavcodec/error_resilience.c

Published Nov 23, 2013 CVSS 2.0 · 4.3 Medium EPSS 2.3% KEV · Not listed
Description
The ff_er_frame_end function in libavcodec/error_resilience.c in FFmpeg before 1.0.4 and 1.1.x before 1.1.1 does not properly verify that a frame is fully initialized, which allows remote attackers to trigger a NULL pointer dereference via crafted picture data.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DSA Debian DSA DSA-3003-1 libav security update
EUVD EUVD EUVD-2013-0871 The ff_er_frame_end function in libavcodec/error_resilience.c in FFmpeg before 1.0.4 and 1.1.x before 1.1.1 does not properly verify that a frame is fully initialized, which allows remote attackers to trigger a NULL pointer dereference via crafted picture data.
History
Type Values Removed Values Added
Metrics epss

{'score': 0.00768}

epss

{'score': 0.00891}

Weaknesses

Sources

Status
PUBLISHED
Assigner
Chrome
Published
Updated
Aug 6, 2024, 2:41 PM
Reserved
Jan 7, 2013, 12:00 AM
Status
Modified
Published
Nov 23, 2013, 6:55 PM
Modified
Jun 16, 2026, 11:50 PM
Severity
Low
Public date
Jan 11, 2013, 12:00 AM