CVE-2008-4866: ffmpeg

CVSS: 10.0v2.0HighModified

AliasesDEBIAN-CVE-2008-4866

Published 31-10-2008Last modified 07-08-2024

Vulnerability summary

CVE-2008-4866 is a high (CVSS 10.0) vulnerability in ffmpeg. EPSS estimates a 4.69% chance of exploitation in the next 30 days, higher than 91.6% of scored vulnerabilities. 3 public exploits are recorded.

Overall risk

90/100

0100

Critical · default modelHow is this calculated?

CVSS score

10.0/10

010

High · v2.0 (NVD)

EPSS score

4.69%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits3reference

Advisory lineage

Upstream 0 · Downstream 1

DSA-1782-1

Timeline

31-10-2008
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Multiple buffer overflows in libavformat/utils.c in FFmpeg 0.4.9 before r14715, as used by MPlayer, allow context-dependent attackers to have an unknown impact via vectors related to execution of DTS generation code with a delay greater than MAX_REORDER_DELAY.

CVSS metrics

1 score · 1 source · 1 version

v2.010.0

EPSS trend

Probability

4.69%

Chance of exploitation in the next 30 days

Percentile

92%

Versus all other CVEs

30-day change

0.00 pp

From 4.69% on 20-09-2026

20-09-202620-10-2026

EPSS score

4.69%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

3 found

referenceUnverified
Exploit Reference (lists.mplayerhq.hu)
Maturity: unknown
referenceUnverified
Exploit Reference (archives.neohapsis.com)
Maturity: unknown
referenceUnverified
Exploit Reference (lists.mplayerhq.hu)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Affected systems

Debian2 products

ffmpeg< 0.svn20080206-14
mplayer< 1.0~rc2-14

Ffmpeg1 product

ffmpeg≤ 0.4.9 | 0.3 | 0.3.1 | 0.3.2 | 0.3.3 | 0.3.4 | 0.4.0 | 0.4.2 | 0.4.3 | 0.4.4 | 0.4.5 | 0.4.6 | 0.4.7 | 0.4.8

2 vendors · 3 products

References

15 links

exchange.xforce.ibmcloud.com/vulnerabilities/46322VDB EntryX Refsource XF
secunia.com/advisories/34845Third Party AdvisoryX Refsource SECUNIA
lists.mplayerhq.hu/pipermail/ffmpeg-cvslog/2008-August/016011.htmlMailing ListX Refsource MLISTExploit
www.mandriva.com/security/advisories?name=MDVSA-2009:013Vendor AdvisoryX Refsource MANDRIVA
www.mandriva.com/security/advisories?name=MDVSA-2009:015Vendor AdvisoryX Refsource MANDRIVA
www.securityfocus.com/bid/33308VDB EntryX Refsource BID
archives.neohapsis.com/archives/fulldisclosure/2008-09/0103.htmlMailing ListX Refsource FULLDISCExploit
www.ubuntu.com/usn/USN-734-1Vendor AdvisoryX Refsource UBUNTU
lists.mplayerhq.hu/pipermail/ffmpeg-cvslog/2008-August/016012.htmlMailing ListX Refsource MLISTExploit
www.debian.org/security/2009/dsa-1782Vendor AdvisoryX Refsource DEBIAN

Show all 15 references

www.openwall.com/lists/oss-security/2008/10/29/6Mailing ListX Refsource MLIST
secunia.com/advisories/34385Third Party AdvisoryX Refsource SECUNIA
security.gentoo.org/glsa/glsa-200903-33.xmlVendor AdvisoryX Refsource GENTOO
secunia.com/advisories/34296Third Party AdvisoryX Refsource SECUNIA
security-tracker.debian.org/tracker/CVE-2008-4866Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities