PT-2011-2379 · Google+1 · Google Chrome+2

Published 2011-01-14 · Updated 2020-07-24 · CVE-2011-0480

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FFmpeg versions used in Google Chrome before 8.0.552.237 Google Chrome before 8.0.552.237 Chrome OS before 8.0.552.344

Description The issue is related to multiple buffer overflows in the Vorbis decoder, specifically in the vorbis dec.c file. This can be exploited by remote attackers using a crafted WebM file, potentially leading to a denial of service through memory corruption and application crash. The buffer overflows are related to buffers for the channel floor and the channel residue.

Recommendations For Google Chrome before 8.0.552.237, update to version 8.0.552.237 or later to resolve the issue. For Chrome OS before 8.0.552.344, update to version 8.0.552.344 or later to resolve the issue. As a temporary workaround, consider avoiding the use of crafted WebM files until the issue is resolved.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2011-0480

DSA-2306-1

Affected Products

Chrome Os

Ffmpeg

Google Chrome

References · 24

• 🔥 http://code.google.com/p/chromium/issues/detail?id=68115 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-0480 · Vendor Advisory
• http://codereview.chromium.org/5964011 · Vendor Advisory
• http://ubuntu.com/usn/usn-1104-1 · Vendor Advisory
• http://googlechromereleases.blogspot.com/2011/01/chrome-stable-release.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-0480 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-0480 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2011:061 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-0480 · Security Note
• http://codereview.chromium.org/6069005 · Vendor Advisory
• http://debian.org/security/2011/dsa-2306 · Vendor Advisory
• http://osvdb.org/70463 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14380 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64671 · Note
• http://ffmpeg.mplayerhq.hu · Note