{"id":"CVE-2013-3674","aliases":["DSA-3003-1","EUVD-2013-3607","GHSA-mcpm-3gj3-9m4h","MGASA-2013-0182"],"status":"published","title":"The cdg_decode_frame function in cdgraphics.c in libavcodec in FFmpeg before 1.2.1 does not...","description":"The cdg_decode_frame function in cdgraphics.c in libavcodec in FFmpeg before 1.2.1 does not validate the presence of non-header data in a buffer, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted CD Graphics Video data.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01962,"percentile":0.80463,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-20"],"published":"2013-06-10T01:00:00Z","modified":"2026-06-16T23:55:37Z","affected":[{"source":"osv","ecosystem":"Debian:7","package":"libav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6:0.8.15-1"}]}],"versions":["6:0.8.10-1","6:0.8.12-1","6:0.8.13-1","6:0.8.6-1","6:0.8.7-1","6:0.8.8-1","6:0.8.9-1"],"bundled":11},{"source":"osv","ecosystem":"Mageia:3","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.5-1.mga3"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:3","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.5-1.mga3.tainted"}]}],"bundled":4}],"products":[{"vendor":"ffmpeg","product":"ffmpeg"}],"references":[{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2014:227","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred"]},{"url":"http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=7ef2dbd2392e3e4d430e0173e1e5c4df9f18b6dd","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://ffmpeg.org/security.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=ad002e1a13a8df934bd6cb2c84175a4780ab8942","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-3674"},{"url":"http://git.videolan.org/?p=ffmpeg.git;a=commit;h=7ef2dbd2392e3e4d430e0173e1e5c4df9f18b6dd"},{"url":"http://git.videolan.org/?p=ffmpeg.git;a=commit;h=ad002e1a13a8df934bd6cb2c84175a4780ab8942"},{"url":"https://github.com/advisories/GHSA-mcpm-3gj3-9m4h"},{"url":"https://advisories.mageia.org/MGASA-2013-0182.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=10506","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2013-3674","description":"The cdg_decode_frame function in cdgraphics.c in libavcodec in FFmpeg before 1.2.1 does not validate the presence of non-header data in a buffer, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted CD Graphics Video data.","status":"published","published":"2013-06-10T01:00:00Z","modified":"2024-08-06T16:14:56.615Z","updated_at":"2026-11-02T14:34:56.872243Z"}],"euvd":[{"id":"EUVD-2013-3607","description":"The cdg_decode_frame function in cdgraphics.c in libavcodec in FFmpeg before 1.2.1 does not validate the presence of non-header data in a buffer, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted CD Graphics Video data.","status":"published","published":"2013-06-10T01:00:00Z","modified":"2024-08-06T16:14:56Z","updated_at":"2026-11-03T01:56:34.623989Z"}],"ghsa":[{"id":"GHSA-mcpm-3gj3-9m4h","title":"The cdg_decode_frame function in cdgraphics.c in libavcodec in FFmpeg before 1.2.1 does not...","description":"The cdg_decode_frame function in cdgraphics.c in libavcodec in FFmpeg before 1.2.1 does not validate the presence of non-header data in a buffer, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted CD Graphics Video data.","status":"published","published":"2022-05-17T04:04:02Z","modified":"2025-04-11T04:11:59Z","cwes":["CWE-20"],"updated_at":"2026-11-02T15:01:14.028836Z"}],"nvd":[{"id":"CVE-2013-3674","description":"The cdg_decode_frame function in cdgraphics.c in libavcodec in FFmpeg before 1.2.1 does not validate the presence of non-header data in a buffer, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted CD Graphics Video data.","status":"published","published":"2013-06-10T03:19:55.033Z","modified":"2026-06-16T23:55:37.327Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:29.210317Z"}],"osv":[{"id":"DSA-3003-1","title":"libav - security update","status":"published","published":"2014-08-10T00:00:00Z","modified":"2026-03-09T01:18:01.468992Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2013-0182","title":"Updated ffmpeg packages fix several security vulnerabilities","description":"ffmpeg prior to 1.1.5 contains several security vulnerabilities\n\n* CVE-2013-3671:\nThe format_line function in log.c in libavutil uses inapplicable offset\ndata during a certain category calculation, which allows remote attackers\nto cause a denial of service (invalid pointer dereference and application\ncrash) via crafted data that triggers a log message.\n\n* CVE-2013-3672:\nThe mm_decode_inter function in mmvideo.c in libavcodec does not validate\nthe relationship between a horizontal coordinate and a width value, which\nallows remote attackers to cause a denial of service (out-of-bounds array\naccess and application crash) via crafted American Laser Games (ALG) MM\nVideo data.\n\n* CVE-2013-3673:\nThe gif_decode_frame function in gifdec.c in libavcodec does not properly\nmanage the disposal methods of frames, which allows remote attackers to\ncause a denial of service (out-of-bounds array access and application crash)\nvia crafted GIF data.\n\n* CVE-2013-3674:\nThe cdg_decode_frame function in cdgraphics.c in libavcodec does not validate\nthe presence of non-header data in a buffer, which allows remote attackers to\ncause a denial of service (out-of-bounds array access and application crash)\nvia crafted CD Graphics Video data.\n\nThe ffmpeg packages have been updated to fix above security vulnerabilities,\nwith extra bugs-fixes.\n","status":"published","published":"2013-06-26T18:09:19Z","modified":"2026-04-16T04:42:18.266413325Z","updated_at":"2026-11-02T15:49:39.121227Z"}]}}