Integer underflow in the asfrtp_parse_packet function in libavformat/rtpdec_asf.c in FFmpeg before 0.8.3 allows remote attackers to execute arbitrary code via a crafted ASF packet.
Weakness
The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Ffmpeg | Ffmpeg | * | 0.8.3 (excluding) |
| Ffmpeg | Ubuntu | hardy | * |
| Ffmpeg | Ubuntu | upstream | * |
| Libav | Ubuntu | oneiric | * |
| Libav | Ubuntu | upstream | * |
| Libav-extra | Ubuntu | oneiric | * |
References
- http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=c2a2ad133eb9d42361804a568dee336992349a5e
- http://git.videolan.org/?p=ffmpeg.git%3Ba=shortlog%3Bh=n0.8.3
- http://technet.microsoft.com/en-us/security/msvr/msvr11-012
- http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=c2a2ad133eb9d42361804a568dee336992349a5e
- http://git.videolan.org/?p=ffmpeg.git%3Ba=shortlog%3Bh=n0.8.3
- http://technet.microsoft.com/en-us/security/msvr/msvr11-012