CVE Vulnerabilities

CVE-2018-13300

Out-of-bounds Read

Published: Jul 05, 2018 | Modified: Nov 21, 2024
CVSS 3.x
8.1
HIGH
Source:
NVD
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
CVSS 2.x
5.8 MEDIUM
AV:N/AC:M/Au:N/C:P/I:N/A:P
RedHat/V2
RedHat/V3
Ubuntu
MEDIUM

In FFmpeg 3.2 and 4.0.1, an improper argument (AVCodecParameters) passed to the avpriv_request_sample function in the handle_eac3 function in libavformat/movenc.c may trigger an out-of-array read while converting a crafted AVI file to MPEG4, leading to a denial of service and possibly an information disclosure.

Weakness

The product reads data past the end, or before the beginning, of the intended buffer.

Affected Software

Name Vendor Start Version End Version
Ffmpeg Ffmpeg 4.0.1 (including) 4.0.1 (including)
Chromium-browser Ubuntu artful *
Chromium-browser Ubuntu bionic *
Chromium-browser Ubuntu cosmic *
Chromium-browser Ubuntu devel *
Chromium-browser Ubuntu disco *
Chromium-browser Ubuntu eoan *
Chromium-browser Ubuntu esm-apps/noble *
Chromium-browser Ubuntu focal *
Chromium-browser Ubuntu groovy *
Chromium-browser Ubuntu hirsute *
Chromium-browser Ubuntu impish *
Chromium-browser Ubuntu jammy *
Chromium-browser Ubuntu kinetic *
Chromium-browser Ubuntu lunar *
Chromium-browser Ubuntu mantic *
Chromium-browser Ubuntu noble *
Chromium-browser Ubuntu oracular *
Chromium-browser Ubuntu trusty *
Chromium-browser Ubuntu upstream *
Chromium-browser Ubuntu xenial *
Ffmpeg Ubuntu artful *
Ffmpeg Ubuntu bionic *
Ffmpeg Ubuntu cosmic *
Ffmpeg Ubuntu devel *
Ffmpeg Ubuntu disco *
Ffmpeg Ubuntu eoan *
Ffmpeg Ubuntu focal *
Ffmpeg Ubuntu groovy *
Ffmpeg Ubuntu hirsute *
Ffmpeg Ubuntu impish *
Ffmpeg Ubuntu jammy *
Ffmpeg Ubuntu kinetic *
Ffmpeg Ubuntu lunar *
Ffmpeg Ubuntu mantic *
Ffmpeg Ubuntu noble *
Ffmpeg Ubuntu oracular *
Ffmpeg Ubuntu upstream *
Gst-libav1.0 Ubuntu artful *
Gst-libav1.0 Ubuntu bionic *
Gst-libav1.0 Ubuntu cosmic *
Gst-libav1.0 Ubuntu disco *
Gst-libav1.0 Ubuntu eoan *
Gst-libav1.0 Ubuntu groovy *
Gst-libav1.0 Ubuntu hirsute *
Gst-libav1.0 Ubuntu impish *
Gst-libav1.0 Ubuntu kinetic *
Gst-libav1.0 Ubuntu lunar *
Gst-libav1.0 Ubuntu mantic *
Gst-libav1.0 Ubuntu trusty *
Gst-libav1.0 Ubuntu xenial *
Kino Ubuntu artful *
Kino Ubuntu bionic *
Kino Ubuntu cosmic *
Kino Ubuntu disco *
Kino Ubuntu eoan *
Kino Ubuntu groovy *
Kino Ubuntu hirsute *
Kino Ubuntu impish *
Kino Ubuntu trusty *
Kino Ubuntu xenial *
Mplayer Ubuntu artful *
Mythtv Ubuntu artful *
Mythtv Ubuntu bionic *
Mythtv Ubuntu cosmic *
Mythtv Ubuntu disco *
Mythtv Ubuntu eoan *
Mythtv Ubuntu groovy *
Mythtv Ubuntu hirsute *
Mythtv Ubuntu impish *
Mythtv Ubuntu kinetic *
Mythtv Ubuntu lunar *
Mythtv Ubuntu mantic *
Mythtv Ubuntu trusty *
Mythtv Ubuntu xenial *
Oxide-qt Ubuntu artful *
Oxide-qt Ubuntu esm-infra/xenial *
Oxide-qt Ubuntu trusty *
Oxide-qt Ubuntu xenial *
Vice Ubuntu artful *
Vice Ubuntu bionic *
Vice Ubuntu cosmic *
Vice Ubuntu disco *
Vice Ubuntu eoan *
Vice Ubuntu groovy *
Vice Ubuntu hirsute *
Vice Ubuntu impish *
Vice Ubuntu kinetic *
Vice Ubuntu lunar *
Vice Ubuntu mantic *
Vice Ubuntu trusty *
Vice Ubuntu xenial *
Vlc Ubuntu artful *

Potential Mitigations

  • Assume all input is malicious. Use an “accept known good” input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
  • When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, “boat” may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as “red” or “blue.”
  • Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code’s environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
  • To reduce the likelihood of introducing an out-of-bounds read, ensure that you validate and ensure correct calculations for any length argument, buffer size calculation, or offset. Be especially careful of relying on a sentinel (i.e. special character such as NUL) in untrusted inputs.

References