VIR Vulnerability Intelligence Relay

CVE-2012-0947

medium
Published 2012-08-20 · Modified 2026-04-29
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
—
CVSS v4 NEW
—
not yet in upstream
VIR risk
6.8

Description

Heap-based buffer overflow in the vqa_decode_chunk function in the VQA codec (vqavideo.c) in libavcodec in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.6, and 0.8.x before 0.8.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted VQA media file in which the image size is not a multiple of the block size.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

OS impact
debian Debian Fixed 5 releases
VersionStatusFixed in
trixie Fixed 7:2.4.1-1
sid Fixed 7:2.4.1-1
forky Fixed 7:2.4.1-1
bullseye Fixed 7:2.4.1-1
bookworm Fixed 7:2.4.1-1

Application impact
VendorProductVersionsFixed
libavlibav0.5
libavlibav0.5.1
libavlibav0.5.2
libavlibav0.5.3
libavlibav0.5.4
libavlibav0.5.5
libavlibav0.5.6
libavlibav0.5.7
libavlibav0.6
libavlibav0.6.1
libavlibav0.6.2
libavlibav0.6.3
libavlibav0.6.4
libavlibav0.6.5
libavlibav0.7
libavlibav0.7.1
libavlibav0.7.2
libavlibav0.7.3
libavlibav0.7.4
libavlibav0.7.5
libavlibav0.8
libavlibav0.8.1

References

CWEs

CWE-119

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.