CVE-2012-5144

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-12-12 · updated 2026-06-16
Weakness: CWE-119

Description

Google Chrome before 23.0.1271.97, and Libav 0.7.x before 0.7.7 and 0.8.x before 0.8.5, do not properly perform AAC decoding, which allows remote attackers to cause a denial of service (stack memory corruption) or possibly have unspecified other impact via vectors related to "an off-by-one overwrite when switching to LTP profile from MAIN."

Affected products

Canonical Ubuntu Linux: 11.10, 12.04, 12.10
Google Chrome: through 23.0.1271.96; 23.0.1271.0, 23.0.1271.1, 23.0.1271.2, 23.0.1271.3, 23.0.1271.4, 23.0.1271.5 (+61)
libav: 0.8, 0.8-beta2, 0.8.1, 0.8.2, 0.8.3, 0.8.4 (+9)
Opensuse: 12.1, 12.2

References

http://googlechromereleases.blogspot.com/2012/12/stable-channel-update.html
http://libav.org/releases/libav-0.7.7.changelog
http://libav.org/releases/libav-0.8.5.changelog
http://lists.opensuse.org/opensuse-updates/2012-12/msg00073.html
http://www.ubuntu.com/usn/USN-1705-1
https://code.google.com/p/chromium/issues/detail?id=161639
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16007
http://googlechromereleases.blogspot.com/2012/12/stable-channel-update.html
http://libav.org/releases/libav-0.7.7.changelog
http://libav.org/releases/libav-0.8.5.changelog
http://lists.opensuse.org/opensuse-updates/2012-12/msg00073.html
http://www.ubuntu.com/usn/USN-1705-1

Get alerted when CVE-2012-5144 or the next vulnerability affects your stack