PT-2011-3484 · FFmpeg+2 · Ffmpeg+3

Dominic Chell · Published 2011-07-07 · Updated 2011-09-22 · CVE-2011-1931

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 0.6.3 libav versions prior to 0.6.3 libavcodec in FFmpeg versions prior to 0.6.3 VideoLAN VLC media player versions 1.1.9 and earlier

Description The issue is related to a write operation outside the bounds of an array in the Sunplus SP5X JPEG decoder, which can lead to memory corruption or possibly allow remote attackers to execute arbitrary code. This can be achieved via a malformed AMV file.

Recommendations For FFmpeg versions prior to 0.6.3, update to version 0.6.3 or later. For libav versions prior to 0.6.3, update to version 0.6.3 or later. For VideoLAN VLC media player versions 1.1.9 and earlier, update to a version later than 1.1.9.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2011-1931

Affected Products

Ffmpeg

Vlc Media Player

Libav

Libavcodec

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2011-1931 · Security Note
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=624339 · Patch
• http://securityfocus.com/bid/47602 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1931 · Note
• http://securityfocus.com/archive/1/517706 · Note
• http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=89f903b3d5ec38c9c5d90fba7e626fa0eda61a32 · Note
• http://securityreason.com/securityalert/8299 · Note