CVE-2012-2803 | Vulnerability Database | Aqua Security

Double free vulnerability in the mpeg_decode_frame function in libavcodec/mpeg12.c in FFmpeg before 0.11, and Libav 0.7.x before 0.7.7 and 0.8.x before 0.8.5, has unknown impact and attack vectors, related to resetting the data size value.

Affected Software

Name	Vendor	Start Version	End Version
Libav	Libav	0.8 (including)	0.8 (including)
Libav	Libav	0.8-beta2 (including)	0.8-beta2 (including)
Libav	Libav	0.8.1 (including)	0.8.1 (including)
Libav	Libav	0.8.2 (including)	0.8.2 (including)
Libav	Libav	0.8.3 (including)	0.8.3 (including)
Libav	Libav	0.8.4 (including)	0.8.4 (including)
Ffmpeg	Ubuntu	hardy	*
Ffmpeg	Ubuntu	lucid	*
Ffmpeg	Ubuntu	upstream	*
Ffmpeg-extra	Ubuntu	lucid	*
Libav	Ubuntu	devel	*
Libav	Ubuntu	natty	*
Libav	Ubuntu	oneiric	*
Libav	Ubuntu	precise	*
Libav	Ubuntu	quantal	*
Libav	Ubuntu	upstream	*
Libav-extra	Ubuntu	devel	*
Libav-extra	Ubuntu	natty	*
Libav-extra	Ubuntu	oneiric	*
Libav-extra	Ubuntu	precise	*
Libav-extra	Ubuntu	quantal	*
Libav-extra	Ubuntu	upstream	*

References

http://ffmpeg.org/security.html
http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=951cbea56fdc03ef96d07fbd7e5bed755d42ac8a
http://libav.org/releases/libav-0.7.7.changelog
http://libav.org/releases/libav-0.8.5.changelog
http://secunia.com/advisories/50468
http://www.openwall.com/lists/oss-security/2012/08/31/3
http://www.openwall.com/lists/oss-security/2012/09/02/4
http://www.securityfocus.com/bid/55355
http://www.ubuntu.com/usn/USN-1705-1
http://www.ubuntu.com/usn/USN-1706-1

NVD	https://nvd.nist.gov/vuln/detail/CVE-2012-2803
CWE	https://cwe.mitre.org/data/definitions/399.html