CVE-2008-4868 | Ubuntu

Description

Unspecified vulnerability in the avcodec_close function in libavcodec/utils.c in FFmpeg 0.4.9 before r14787, as used by MPlayer, has unknown impact and attack vectors, related to a free "on random pointers."

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
ffmpeg	11.10 oneiric	Not in release
	11.04 natty	Not in release
	10.10 maverick	Not affected
	10.04 LTS lucid	Not affected
	9.10 karmic	Not affected
	9.04 jaunty	Not affected
	8.10 intrepid	Not affected
	8.04 LTS hardy	Not affected
	7.10 gutsy	Not affected
	6.06 LTS dapper	Ignored end of life
ffmpeg-debian	11.10 oneiric	Not in release
	11.04 natty	Not in release
	10.10 maverick	Not in release
	10.04 LTS lucid	Not in release
	9.10 karmic	Not in release
	9.04 jaunty	Not affected
	8.10 intrepid	Not affected
	8.04 LTS hardy	Not in release
	7.10 gutsy	Not in release
	7.04 feisty	Not in release
	6.06 LTS dapper	Not in release
gstreamer0.10-ffmpeg	11.10 oneiric	Not affected
	11.04 natty	Not affected
	10.10 maverick	Not affected
	10.04 LTS lucid	Not affected
	9.10 karmic	Not affected
	9.04 jaunty	Not affected
	8.10 intrepid	Not affected
	8.04 LTS hardy	Not affected
	7.10 gutsy	Ignored end of life, was needed
	6.06 LTS dapper	Ignored end of life
kino	11.10 oneiric	Not affected
	11.04 natty	Not affected
	10.10 maverick	Not affected
	10.04 LTS lucid	Not affected
	9.10 karmic	Not affected
	9.04 jaunty	Not affected
	8.10 intrepid	Not affected
	8.04 LTS hardy	Not affected
	7.10 gutsy	Not affected
	6.06 LTS dapper	Not affected
mplayer	11.10 oneiric	Not affected
	11.04 natty	Not affected
	10.10 maverick	Not affected
	10.04 LTS lucid	Not affected
	9.10 karmic	Ignored end of life
	9.04 jaunty	Ignored end of life
	8.10 intrepid	Ignored end of life, was needed
	8.04 LTS hardy	Ignored end of life
	7.10 gutsy	Ignored end of life, was needed
	6.06 LTS dapper	Ignored end of life
xmovie	11.10 oneiric	Not in release
	11.04 natty	Not in release
	10.10 maverick	Not in release
	10.04 LTS lucid	Not in release
	9.10 karmic	Not in release
	9.04 jaunty	Not in release
	8.10 intrepid	Not in release
	8.04 LTS hardy	Not in release
	7.10 gutsy	Not in release
	6.06 LTS dapper	Ignored end of life

Notes

mdeslaur

Code in ffmpeg in gutsy, hardy, intrepid and jaunty doesn't free, so not vulnerable. kino is built with --disable-local-ffmpeg, so it's not vulnerable

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
ffmpeg	Introduced by http://, fixed by - Break-fix: http://git.ffmpeg.org/?p=ffmpeg;a=commit;h=03bbae75cfbdac8012251eceb5748430f34c83d9 - Upstream: http://svn.ffmpeg.org/ffmpeg/trunk/libavcodec/utils.c?r1=14766&r2=14787 Upstream: http://svn.ffmpeg.org/ffmpeg/trunk/libavcodec/utils.c?r1=14787&r2=14788 Upstream: http://git.ffmpeg.org/?p=ffmpeg;a=commitdiff;h=e0c16d7619617d726f5fa4f586ff74a43f445a89 Upstream: http://git.ffmpeg.org/?p=ffmpeg;a=commit;h=be8ff464977e36d7784a2dd1a9cb1a6d32ef4574

Package

Patch details

ffmpeg

Introduced by http://, fixed by -
Break-fix: http://git.ffmpeg.org/?p=ffmpeg;a=commit;h=03bbae75cfbdac8012251eceb5748430f34c83d9 -
Upstream: http://svn.ffmpeg.org/ffmpeg/trunk/libavcodec/utils.c?r1=14766&r2=14787
Upstream: http://svn.ffmpeg.org/ffmpeg/trunk/libavcodec/utils.c?r1=14787&r2=14788
Upstream: http://git.ffmpeg.org/?p=ffmpeg;a=commitdiff;h=e0c16d7619617d726f5fa4f586ff74a43f445a89
Upstream: http://git.ffmpeg.org/?p=ffmpeg;a=commit;h=be8ff464977e36d7784a2dd1a9cb1a6d32ef4574

References

Other references

https://www.cve.org/CVERecord?id=CVE-2008-4868