Debian Bug report logs - #498766
ffmpeg-debian: vulnerable to denial-of-service attack (CVE-2008-3230)

Display info messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Michael Gilbert <michael.s.gilbert@gmail.com>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: ffmpeg-debian: vulnerable to denial-of-service attack (CVE-2008-3230)

Date: Fri, 12 Sep 2008 22:59:31 -0400

Package: ffmpeg-debian
Version: 0.svn20080206-12
Severity: grave
Tags: security
Justification: user security hole

according to the debian security tracker [1], ffmpeg is known to be
vulnerable to a denial-of-service attack [2].  the description of the
CVE is

  The ffmpeg lavf demuxer allows user-assisted attackers to cause a denial 
  of service (application crash) via a crafted GIF file, possibly related 
  to gstreamer, as demonstrated by lol-giftopnm.gif.

i'm reporting this here to make you aware of the issue, and so the issue
can be tracked as release-critical for etch.  this affects stable, testing, 
and unstable.

thanks for the hard work.

[1] http://security-tracker.debian.net/tracker/CVE-2008-3230
[2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3230

-- System Information:
Debian Release: lenny/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (500, 'testing'), (500, 'stable'), (1, 'experimental')
Architecture: i386 (i686)

Kernel: Linux 2.6.24-etchnhalf.1-686 (SMP w/1 CPU core)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash

Message #16 received at 498766@bugs.debian.org (full text, mbox, reply):

From: Thijs Kinkhorst <thijs@debian.org>

To: 498766@bugs.debian.org

Cc: Michael Gilbert <michael.s.gilbert@gmail.com>, control@bugs.debian.org

Subject: client dos not grave

Date: Sat, 13 Sep 2008 14:30:29 +0200

[Message part 1 (text/plain, inline)]

severity 498766 important
thanks

Hi,

> The ffmpeg lavf demuxer allows user-assisted attackers to cause a denial 
> of service (application crash)

while inconvenient such crashes are not grave bugs (compare to a browser 
crashing on some specific web page).


Thijs

[Message part 2 (application/pgp-signature, inline)]

Message #23 received at 498766-close@bugs.debian.org (full text, mbox, reply):

From: "Michael S. Gilbert" <michael.s.gilbert@gmail.com>

To: 498766-close@bugs.debian.org

Subject: closing

Date: Wed, 8 Apr 2009 11:39:53 -0400

the ffmpeg source package has been remove from the archive, and these
issues are currently fixed in ffmpeg-debian, so there is no reason to
continue to track this issue (see http://bugs.debian.org/498764).

Send a report that this bug log contains spam.