PT-2012-1759 · FFmpeg+1 · Ffmpeg+1

Gynvael Coldwind

+1

·

Publicado

2012-08-20

·

Atualizado

2018-10-30

·

CVE-2011-3952

CVSS v2.0

6.8

Média

VetorAV:N/AC:M/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 0.10 Libav versions 0.5.x through 0.5.8 Libav versions 0.6.x through 0.6.5 Libav versions 0.7.x through 0.7.5 Libav versions 0.8.x through 0.8.0
Description The issue allows remote attackers to cause a denial of service, potentially leading to application crashes, and possibly execute arbitrary code. This is achieved through a large palette size in a KMVC encoded file, exploiting the decode init function in kmvc.c in libavcodec.
Recommendations For FFmpeg versions prior to 0.10, update to version 0.10 or later. For Libav versions 0.5.x through 0.5.8, update to version 0.5.9 or later. For Libav versions 0.6.x through 0.6.5, update to version 0.6.6 or later. For Libav versions 0.7.x through 0.7.5, update to version 0.7.6 or later. For Libav versions 0.8.x through 0.8.0, update to version 0.8.1 or later.

Correção

RCE

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2011-3952
DSA-2494-1

Produtos afetados

Ffmpeg
Libav