Multiple vulnerabilities have been reported in FFmpeg, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise a user's system.

The vulnerabilities are caused due to various errors within the 4xm, ADPCM IMA Electronic Arts EACS, ANM, Electronic Arts CMV, PTX, QDM2, QuickDraw, TIFF, Tiertex Limited SEQ, aac, bink, flic, h264, indeo2, jpeg 2000, mpc v8, rasterfile, shorten, sun raster, vmd audio, wmapro, wmavoice, and xan decoders, the 4X Technologies, Deluxe Paint Animation, avi, and avs demuxers, the libx264 interface to the x264 encoder, the unsharp filter, and the mov muxer, which can be exploited to e.g. cause NULL pointer dereferences, out-of-bounds reads and writes, double-frees, and buffer overflows via e.g. specially crafted media content.

The vulnerabilities are reported in versions prior to 0.7.6 and 0.8.5.

1) A boundary error within the "cinvideo_decode_frame()" function (libavcodec/dsicinav.c) can be exploited to cause a heap based buffer overflow via a Delphine Software International CIN (*.CIN) file containing a frame with an overly large number of palette colors.

2) The "qdm2_decode_init()" function (libavcodec/qdm2.c) does not properly limit the number of channels, which can be exploited to e.g. cause an out-of-bounds write within the "fill_tone_level_array()" function (libavcodec/qdm2.c) via specially crafted media files.

3) An error in the "vmd_decode()" function (libavcodec/vmdav.c) when parsing a video frame's X and Y offset values can be exploited to cause an out-of-bounds write via a specially crafted VMD file.

Solution
Update to version 0.7.6 and 0.8.5.

Provided and/or discovered by
1 - 2) Reported by the vendor.
3) Fabian Yamaguchi1, Felix ’FX’ Lindner1, and Konrad Rieck2 via USENIX WOOT'11.

Changelog
Further details available to Secunia VIM customers

Original Advisory
FFmpeg:
http://ffmpeg.org/#pr7dot6and8dot5

USENIX WOOT'11:
http://www.usenix.org/events/woot11/tech/final_files/Yamaguchi.pdf

Technical Analysis
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers