Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.0
CVE-2012-6616: FFmpeg: Out-of-bounds read causes denial of service and crash
CVE-2012-6616 · published 12 years ago
Summary
A flaw exists in older versions of FFmpeg that can be exploited by a remote attacker to crash the software. This can happen when FFmpeg is used to process specially crafted 3GPP data. To protect your system, update to FFmpeg version 1.0.2 or later.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:14.04:LTS | canonical | libav | All versions |
| Ubuntu:16.04:LTS | canonical | gst-libav1.0 | All versions |
| Ubuntu:16.04:LTS | canonical | mythtv | All versions |
| Ubuntu:16.04:LTS | canonical | oxide-qt | All versions |
| Ubuntu:18.04:LTS | canonical | gst-libav1.0 | All versions |
| Ubuntu:18.04:LTS | canonical | mythtv | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | qtwebengine-opensource-src | All versions |
| Ubuntu:20.04:LTS | canonical | gst-libav1.0 | All versions |
| Ubuntu:20.04:LTS | canonical | mythtv | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | qtwebengine-opensource-src | All versions |
| Ubuntu:22.04:LTS | canonical | gst-libav1.0 | All versions |
| Ubuntu:22.04:LTS | canonical | mythtv | All versions |
| Ubuntu:Pro:22.04:LTS | canonical | qtwebengine-opensource-src | All versions |
| Ubuntu:24.04:LTS | canonical | gst-libav1.0 | All versions |
| Ubuntu:24.04:LTS | canonical | mythtv | All versions |
| Ubuntu:Pro:24.04:LTS | canonical | qtwebengine-opensource-src | All versions |
| Ubuntu:25.10 | canonical | gst-libav1.0 | All versions |
| Ubuntu:25.10 | canonical | mythtv | All versions |
| Ubuntu:25.10 | canonical | qtwebengine-opensource-src | All versions |
| Ubuntu:26.04:LTS | canonical | gst-libav1.0 | All versions |
| Ubuntu:26.04:LTS | canonical | mythtv | All versions |
| Ubuntu:Pro:26.04:LTS | canonical | qtwebengine-opensource-src | All versions |
| – | ffmpeg | ffmpeg |
<= 1.0.1 1.0 cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:* |
Original advisory text
The mov_text_decode_frame function in libavcodec/movtextdec.c in FFmpeg before 1.0.2 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via crafted 3GPP TS 26.245 d...
The mov_text_decode_frame function in libavcodec/movtextdec.c in FFmpeg before 1.0.2 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via crafted 3GPP TS 26.245 data.
References
- https://ubuntu.com/security/CVE-2012-6616 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2012-6616 Third Party Advisory
- http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=68e48ed72e0597ae61bc3e9...
- http://secunia.com/advisories/51964 Vendor Advisory
- http://www.ffmpeg.org/security.html
- http://www.osvdb.org/93242
- https://trac.ffmpeg.org/ticket/2087 Exploit
Severity
5.0
Medium
Type
CWE-119Buffer Overflow
Timeline
Published24 Dec 2013
Updated3 Nov 2026
First seen3 Jun 2026
Track software like this
Free during beta