Nom du paquet
xmovie
Date
2005-12-14
Advisory ID
MDKSA-2005:229
Affected versions
CS3.0 i586 , 2006.0 i586

Problem description

Simon Kilvington discovered a vulnerability in FFmpeg libavcodec,
which can be exploited by malicious people to cause a DoS (Denial
of Service) and potentially to compromise a user's system.

The vulnerability is caused due to a boundary error in the
"avcodec_default_get_buffer()" function of "utils.c" in libavcodec.
This can be exploited to cause a heap-based buffer overflow when a
specially-crafted 1x1 ".png" file containing a palette is read.

Xmovie is built with a private copy of ffmpeg containing this
same code.

The updated packages have been patched to prevent this problem.

Updated packages

CS3.0 i586

 3fae159ac8ab7aa190d341868009e3c6  corporate/3.0/RPMS/xmovie-1.9.11-1.2.C30mdk.i586.rpm
 18674dd3aff5f923ac327bbf134aca8c  corporate/3.0/SRPMS/xmovie-1.9.11-1.2.C30mdk.src.rpm

2006.0 i586

 b6b3622d949af833f6fbb5b89a32a10d  2006.0/RPMS/xmovie-1.9.13-2.2.20060mdk.i586.rpm
 48f0b55b1d8547eb77d3f4cf9787544b  2006.0/SRPMS/xmovie-1.9.13-2.2.20060mdk.src.rpm

References