{"id":"CVE-2013-3673","aliases":["EUVD-2013-3606","GHSA-j837-2gh6-pprf","MGASA-2013-0182"],"status":"published","title":"The gif_decode_frame function in gifdec.c in libavcodec in FFmpeg before 1.2.1 does not properly...","description":"The gif_decode_frame function in gifdec.c in libavcodec in FFmpeg before 1.2.1 does not properly manage the disposal methods of frames, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted GIF data.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02054,"percentile":0.81391,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-119"],"published":"2013-06-10T01:00:00Z","modified":"2026-06-16T23:55:37Z","affected":[{"source":"osv","ecosystem":"Mageia:3","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.5-1.mga3"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:3","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.5-1.mga3.tainted"}]}],"bundled":4}],"products":[{"vendor":"ffmpeg","product":"ffmpeg"}],"references":[{"url":"http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=d23b8462b5a4a9da78ed45c4a7a3b35d538df909","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://ffmpeg.org/security.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=7ee5e97c46e30fb3d6f9f78cc3313dbc06528b37","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-3673"},{"url":"http://git.videolan.org/?p=ffmpeg.git;a=commit;h=7ee5e97c46e30fb3d6f9f78cc3313dbc06528b37"},{"url":"http://git.videolan.org/?p=ffmpeg.git;a=commit;h=d23b8462b5a4a9da78ed45c4a7a3b35d538df909"},{"url":"https://github.com/advisories/GHSA-j837-2gh6-pprf"},{"url":"https://advisories.mageia.org/MGASA-2013-0182.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=10506","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2013-3673","description":"The gif_decode_frame function in gifdec.c in libavcodec in FFmpeg before 1.2.1 does not properly manage the disposal methods of frames, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted GIF data.","status":"published","published":"2013-06-10T01:00:00Z","modified":"2024-09-17T03:48:51.31Z","updated_at":"2026-11-02T14:34:56.530545Z"}],"euvd":[{"id":"EUVD-2013-3606","description":"The gif_decode_frame function in gifdec.c in libavcodec in FFmpeg before 1.2.1 does not properly manage the disposal methods of frames, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted GIF data.","status":"published","published":"2013-06-10T01:00:00Z","modified":"2024-09-17T03:48:51Z","updated_at":"2026-11-03T00:28:28.52027Z"}],"ghsa":[{"id":"GHSA-j837-2gh6-pprf","title":"The gif_decode_frame function in gifdec.c in libavcodec in FFmpeg before 1.2.1 does not properly...","description":"The gif_decode_frame function in gifdec.c in libavcodec in FFmpeg before 1.2.1 does not properly manage the disposal methods of frames, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted GIF data.","status":"published","published":"2022-05-17T05:08:47Z","modified":"2025-04-11T04:11:59Z","cwes":["CWE-119"],"updated_at":"2026-11-02T15:01:14.028836Z"}],"nvd":[{"id":"CVE-2013-3673","description":"The gif_decode_frame function in gifdec.c in libavcodec in FFmpeg before 1.2.1 does not properly manage the disposal methods of frames, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted GIF data.","status":"published","published":"2013-06-10T03:19:55.013Z","modified":"2026-06-16T23:55:37.213Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:02:29.210317Z"}],"osv":[{"id":"MGASA-2013-0182","title":"Updated ffmpeg packages fix several security vulnerabilities","description":"ffmpeg prior to 1.1.5 contains several security vulnerabilities\n\n* CVE-2013-3671:\nThe format_line function in log.c in libavutil uses inapplicable offset\ndata during a certain category calculation, which allows remote attackers\nto cause a denial of service (invalid pointer dereference and application\ncrash) via crafted data that triggers a log message.\n\n* CVE-2013-3672:\nThe mm_decode_inter function in mmvideo.c in libavcodec does not validate\nthe relationship between a horizontal coordinate and a width value, which\nallows remote attackers to cause a denial of service (out-of-bounds array\naccess and application crash) via crafted American Laser Games (ALG) MM\nVideo data.\n\n* CVE-2013-3673:\nThe gif_decode_frame function in gifdec.c in libavcodec does not properly\nmanage the disposal methods of frames, which allows remote attackers to\ncause a denial of service (out-of-bounds array access and application crash)\nvia crafted GIF data.\n\n* CVE-2013-3674:\nThe cdg_decode_frame function in cdgraphics.c in libavcodec does not validate\nthe presence of non-header data in a buffer, which allows remote attackers to\ncause a denial of service (out-of-bounds array access and application crash)\nvia crafted CD Graphics Video data.\n\nThe ffmpeg packages have been updated to fix above security vulnerabilities,\nwith extra bugs-fixes.\n","status":"published","published":"2013-06-26T18:09:19Z","modified":"2026-04-16T04:42:18.266413325Z","updated_at":"2026-11-02T15:49:39.121227Z"}]}}