{"id":"CVE-2013-3672","aliases":["DEBIAN-CVE-2013-3672","DSA-3003-1","EUVD-2013-3605","GHSA-w4jr-ppq4-7m9m","MGASA-2013-0182"],"status":"published","title":"The mm_decode_inter function in mmvideo.c in libavcodec in FFmpeg before 1.2.1 does not validate...","description":"The mm_decode_inter function in mmvideo.c in libavcodec in FFmpeg before 1.2.1 does not validate the relationship between a horizontal coordinate and a width value, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted American Laser Games (ALG) MM Video data.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01357,"percentile":0.71851,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2013-06-10T01:00:00Z","modified":"2026-09-01T20:02:34Z","fixes":[{"ecosystem":"Debian:12","package":"ffmpeg","fixed_in":["7:2.4.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ffmpeg","fixed_in":["7:2.4.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ffmpeg","fixed_in":["7:2.4.1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:2.4.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:2.4.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:2.4.1-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"libav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6:0.8.15-1"}]}],"versions":["6:0.8.10-1","6:0.8.12-1","6:0.8.13-1","6:0.8.6-1","6:0.8.7-1","6:0.8.8-1","6:0.8.9-1"],"bundled":11},{"source":"osv","ecosystem":"Mageia:3","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.5-1.mga3"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:3","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.5-1.mga3.tainted"}]}],"bundled":4}],"products":[{"vendor":"ffmpeg","product":"ffmpeg"}],"references":[{"url":"http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=8d3c99e825317b7efda5fd12e69896b47c700303","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2014:227","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"http://ffmpeg.org/security.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=7fa6db2545643efb4fe2e0bb501fa50af35a6330","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-3672"},{"url":"http://git.videolan.org/?p=ffmpeg.git;a=commit;h=7fa6db2545643efb4fe2e0bb501fa50af35a6330"},{"url":"http://git.videolan.org/?p=ffmpeg.git;a=commit;h=8d3c99e825317b7efda5fd12e69896b47c700303"},{"url":"https://github.com/advisories/GHSA-w4jr-ppq4-7m9m"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-3672","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2013-0182.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=10506","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2013-3672","description":"The mm_decode_inter function in mmvideo.c in libavcodec in FFmpeg before 1.2.1 does not validate the relationship between a horizontal coordinate and a width value, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted American Laser Games (ALG) MM Video data.","status":"published","published":"2013-06-10T01:00:00Z","modified":"2024-08-06T16:14:56.649Z","updated_at":"2026-11-02T14:34:56.872243Z"}],"euvd":[{"id":"EUVD-2013-3605","description":"The mm_decode_inter function in mmvideo.c in libavcodec in FFmpeg before 1.2.1 does not validate the relationship between a horizontal coordinate and a width value, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted American Laser Games (ALG) MM Video data.","status":"published","published":"2013-06-10T01:00:00Z","modified":"2024-08-06T16:14:56Z","updated_at":"2026-11-03T01:56:34.623989Z"}],"ghsa":[{"id":"GHSA-w4jr-ppq4-7m9m","title":"The mm_decode_inter function in mmvideo.c in libavcodec in FFmpeg before 1.2.1 does not validate...","description":"The mm_decode_inter function in mmvideo.c in libavcodec in FFmpeg before 1.2.1 does not validate the relationship between a horizontal coordinate and a width value, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted American Laser Games (ALG) MM Video data.","status":"published","published":"2022-05-17T04:04:02Z","modified":"2025-04-11T04:11:59Z","cwes":["CWE-20"],"updated_at":"2026-11-02T15:01:14.028836Z"}],"nvd":[{"id":"CVE-2013-3672","description":"The mm_decode_inter function in mmvideo.c in libavcodec in FFmpeg before 1.2.1 does not validate the relationship between a horizontal coordinate and a width value, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted American Laser Games (ALG) MM Video data.","status":"published","published":"2013-06-10T03:19:54.98Z","modified":"2026-06-16T23:55:37.097Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:29.210317Z"}],"osv":[{"id":"CVE-2013-3672","description":"The mm_decode_inter function in mmvideo.c in libavcodec in FFmpeg before 1.2.1 does not validate the relationship between a horizontal coordinate and a width value, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted American Laser Games (ALG) MM Video data.","status":"published","published":"2013-06-10T03:19:54Z","modified":"2026-04-16T04:43:25.98590406Z","updated_at":"2026-11-02T15:43:59.09154Z"},{"id":"DEBIAN-CVE-2013-3672","description":"The mm_decode_inter function in mmvideo.c in libavcodec in FFmpeg before 1.2.1 does not validate the relationship between a horizontal coordinate and a width value, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted American Laser Games (ALG) MM Video data.","status":"published","published":"2013-06-10T03:19:54.98Z","modified":"2026-09-01T20:02:34.555815987Z","updated_at":"2026-11-02T15:45:25.514579Z"},{"id":"DSA-3003-1","title":"libav - security update","status":"published","published":"2014-08-10T00:00:00Z","modified":"2026-03-09T01:18:01.468992Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2013-0182","title":"Updated ffmpeg packages fix several security vulnerabilities","description":"ffmpeg prior to 1.1.5 contains several security vulnerabilities\n\n* CVE-2013-3671:\nThe format_line function in log.c in libavutil uses inapplicable offset\ndata during a certain category calculation, which allows remote attackers\nto cause a denial of service (invalid pointer dereference and application\ncrash) via crafted data that triggers a log message.\n\n* CVE-2013-3672:\nThe mm_decode_inter function in mmvideo.c in libavcodec does not validate\nthe relationship between a horizontal coordinate and a width value, which\nallows remote attackers to cause a denial of service (out-of-bounds array\naccess and application crash) via crafted American Laser Games (ALG) MM\nVideo data.\n\n* CVE-2013-3673:\nThe gif_decode_frame function in gifdec.c in libavcodec does not properly\nmanage the disposal methods of frames, which allows remote attackers to\ncause a denial of service (out-of-bounds array access and application crash)\nvia crafted GIF data.\n\n* CVE-2013-3674:\nThe cdg_decode_frame function in cdgraphics.c in libavcodec does not validate\nthe presence of non-header data in a buffer, which allows remote attackers to\ncause a denial of service (out-of-bounds array access and application crash)\nvia crafted CD Graphics Video data.\n\nThe ffmpeg packages have been updated to fix above security vulnerabilities,\nwith extra bugs-fixes.\n","status":"published","published":"2013-06-26T18:09:19Z","modified":"2026-04-16T04:42:18.266413325Z","updated_at":"2026-11-02T15:49:39.121227Z"}]}}