{"id":"CVE-2013-3671","aliases":["EUVD-2013-3604","GHSA-5m89-g37f-fx5p","MGASA-2013-0182"],"status":"published","title":"The format_line function in log.c in libavutil in FFmpeg before 1.2.1 uses inapplicable offset...","description":"The format_line function in log.c in libavutil in FFmpeg before 1.2.1 uses inapplicable offset data during a certain category calculation, which allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via crafted data that triggers a log message.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01357,"percentile":0.7183,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-189"],"published":"2013-06-10T01:00:00Z","modified":"2026-06-16T23:55:36Z","affected":[{"source":"osv","ecosystem":"Mageia:3","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.5-1.mga3"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:3","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.5-1.mga3.tainted"}]}],"bundled":4}],"products":[{"vendor":"ffmpeg","product":"ffmpeg"}],"references":[{"url":"http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=7edb984dd051b6919d7d8471c70499273f31b0fa","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=cc0dd86580b3257f22a4981a79eb5fa6804182b6","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://ffmpeg.org/security.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-3671"},{"url":"http://git.videolan.org/?p=ffmpeg.git;a=commit;h=7edb984dd051b6919d7d8471c70499273f31b0fa"},{"url":"http://git.videolan.org/?p=ffmpeg.git;a=commit;h=cc0dd86580b3257f22a4981a79eb5fa6804182b6"},{"url":"https://github.com/advisories/GHSA-5m89-g37f-fx5p"},{"url":"https://advisories.mageia.org/MGASA-2013-0182.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=10506","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2013-3671","description":"The format_line function in log.c in libavutil in FFmpeg before 1.2.1 uses inapplicable offset data during a certain category calculation, which allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via crafted data that triggers a log message.","status":"published","published":"2013-06-10T01:00:00Z","modified":"2024-09-16T18:54:34.592Z","updated_at":"2026-11-02T14:34:56.872243Z"}],"euvd":[{"id":"EUVD-2013-3604","description":"The format_line function in log.c in libavutil in FFmpeg before 1.2.1 uses inapplicable offset data during a certain category calculation, which allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via crafted data that triggers a log message.","status":"published","published":"2013-06-10T01:00:00Z","modified":"2024-09-16T18:54:34Z","updated_at":"2026-11-03T00:55:28.088118Z"}],"ghsa":[{"id":"GHSA-5m89-g37f-fx5p","title":"The format_line function in log.c in libavutil in FFmpeg before 1.2.1 uses inapplicable offset...","description":"The format_line function in log.c in libavutil in FFmpeg before 1.2.1 uses inapplicable offset data during a certain category calculation, which allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via crafted data that triggers a log message.","status":"published","published":"2022-05-17T05:08:46Z","modified":"2025-04-11T04:11:59Z","updated_at":"2026-11-02T15:01:14.028836Z"}],"nvd":[{"id":"CVE-2013-3671","description":"The format_line function in log.c in libavutil in FFmpeg before 1.2.1 uses inapplicable offset data during a certain category calculation, which allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via crafted data that triggers a log message.","status":"published","published":"2013-06-10T03:19:54.96Z","modified":"2026-06-16T23:55:36.98Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-189"],"updated_at":"2026-11-02T14:02:29.210317Z"}],"osv":[{"id":"MGASA-2013-0182","title":"Updated ffmpeg packages fix several security vulnerabilities","description":"ffmpeg prior to 1.1.5 contains several security vulnerabilities\n\n* CVE-2013-3671:\nThe format_line function in log.c in libavutil uses inapplicable offset\ndata during a certain category calculation, which allows remote attackers\nto cause a denial of service (invalid pointer dereference and application\ncrash) via crafted data that triggers a log message.\n\n* CVE-2013-3672:\nThe mm_decode_inter function in mmvideo.c in libavcodec does not validate\nthe relationship between a horizontal coordinate and a width value, which\nallows remote attackers to cause a denial of service (out-of-bounds array\naccess and application crash) via crafted American Laser Games (ALG) MM\nVideo data.\n\n* CVE-2013-3673:\nThe gif_decode_frame function in gifdec.c in libavcodec does not properly\nmanage the disposal methods of frames, which allows remote attackers to\ncause a denial of service (out-of-bounds array access and application crash)\nvia crafted GIF data.\n\n* CVE-2013-3674:\nThe cdg_decode_frame function in cdgraphics.c in libavcodec does not validate\nthe presence of non-header data in a buffer, which allows remote attackers to\ncause a denial of service (out-of-bounds array access and application crash)\nvia crafted CD Graphics Video data.\n\nThe ffmpeg packages have been updated to fix above security vulnerabilities,\nwith extra bugs-fixes.\n","status":"published","published":"2013-06-26T18:09:19Z","modified":"2026-04-16T04:42:18.266413325Z","updated_at":"2026-11-02T15:49:39.121227Z"}]}}