CVE-2012-5150

Use-after-free vulnerability in Google Chrome before 24.0.1312.52 allows remote attackers to...

7.5 HighFix available

CVE-2012-5150 is a high vulnerability (CVSS 7.5) in Google Chrome, published January 15, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.05%, the 64th percentile. Fixed in ffmpeg 7:2.4.1-1.

What does this mean?

Severity: 7.5 HighCVSS 2.0, NVD
Exploit chance: 1.05%EPSS, 64th percentile
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 7:2.4.1-1ffmpeg +6 more

Description

Use-after-free vulnerability in Google Chrome before 24.0.1312.52 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving seek operations on video data.

Exploit likelihood

1.05%Down 0.2 points since Feb 4, 2022

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`ffmpeg` Debian:12	before 7:2.4.1-1	7:2.4.1-1
`ffmpeg` Debian:13	before 7:2.4.1-1	7:2.4.1-1
`ffmpeg` Debian:14	before 7:2.4.1-1	7:2.4.1-1
`ffmpeg` Mageia:3 From an advisory covering 6 CVEs	before 1.1.12-1.mga3	1.1.12-1.mga3
`ffmpeg` Mageia:3 From an advisory covering 6 CVEs	before 1.1.12-1.mga3.tainted	1.1.12-1.mga3.tainted
`chromium` openSUSE:Tumbleweed From an advisory covering 719 CVEs	before 55.0.2883.75-3.1	55.0.2883.75-3.1
`chromium` openSUSE:Tumbleweed From an advisory covering 2310 CVEs	before 113.0.5672.92-1.1	113.0.5672.92-1.1

What each source reports

NVD Score used7.5

Record: CVE-2012-5150
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-399
Updated: 2026-11-02

CVE ListNo score

Record: CVE-2012-5150
Updated: 2026-11-02

EUVDEUVD-2012-5073No score

Record: EUVD-2012-5073
Updated: 2026-11-03

GitHub AdvisoriesGHSA-x4jx-xq7r-fxx7No score

Use-after-free vulnerability in Google Chrome before 24.0.1312.52 allows remote attackers to...

Record: GHSA-x4jx-xq7r-fxx7
Updated: 2026-11-02

OSVNo score

Record: CVE-2012-5150
Updated: 2026-11-02

OSVDEBIAN-CVE-2012-5150No score

Record: DEBIAN-CVE-2012-5150
Updated: 2026-11-02

OSVMGASA-2014-0281No score

Updated ffmpeg packages fix security vulnerabilities

A use-after-free vulnerability in FFmpeg before 1.1.9 involving seek operations on video data could allow remote attackers to cause a denial of service (CVE-2012-5150).

The tak_decode_frame function in libavcodec/takdec.c in FFmpeg before 1.1.9 does not properly validate a certain bits-per-sample value, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted TAK (aka Tom's lossless Audio Kompressor) data (CVE-2014-2097).

libavcodec/wmalosslessdec.c in FFmpeg before 1.1.9 uses an incorrect data-structure size for certain coefficients, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted WMA data (CVE-2014-2098).

The msrle_decode_frame function in libavcodec/msrle.c in FFmpeg before 1.1.9 does not properly calculate line sizes, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Microsoft RLE video data (CVE-2014-2099).

The mpegts_write_pmt function in the MPEG2 transport stream (aka DVB) muxer (libavformat/mpegtsenc.c) in FFmpeg before 1.1.9 allows remote attackers to have unspecified impact and vectors, which trigger an out-of-bounds write (CVE-2014-2263).

An integer overflow in LZO decompression in FFmpeg before 1.1.12 allows remote attackers to have an unspecified impact by embedding compressed data in a video file (CVE-2014-4610).

This updates provides ffmpeg version 1.1.12, which fixes these issues and several other bugs which were corrected upstream.