PT-2011-4406 · FFmpeg+1 · Libavcodec+2

Moritz · Published 2011-10-02 · Updated 2012-05-18 · CVE-2011-3362

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 0.7.3 FFmpeg versions 0.8.x prior to 0.8.2 libav versions prior to 0.7.2 is not mentioned, but libav through 0.7.1 is affected, so we can say libav versions prior to 0.7.2

Description The issue is related to an integer signedness error in the decode residual block function in cavsdec.c in libavcodec. This error can be exploited by remote attackers using a crafted Chinese AVS video file, potentially leading to a denial of service through memory corruption and application crash, or possibly allowing the execution of arbitrary code.

Recommendations For FFmpeg versions prior to 0.7.3, update to version 0.7.3 or later. For FFmpeg versions 0.8.x prior to 0.8.2, update to version 0.8.2 or later. For libav versions prior to 0.7.2, update to version 0.7.2 or later.

Fix

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2011-3362

DSA-2336-1

Affected Products

Ffmpeg

Libav

Libavcodec

References · 12

• https://osv.dev/vulnerability/DEBIAN-CVE-2011-3362 · Vendor Advisory
• http://secunia.com/advisories/45532 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-3362 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-3362 · Security Note
• http://openwall.com/lists/oss-security/2011/09/14/8 · Patch
• http://openwall.com/lists/oss-security/2011/09/13/4 · Patch
• https://osv.dev/vulnerability/CVE-2011-3362 · Vendor Advisory
• http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=c5cbda50793e311aa73489d12184ffd6761c9fbf · Note
• http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=91d5da9321c52e8197fb14046ebb335f3e6ff4a0 · Note
• http://ffmpeg.org/releases/ffmpeg-0.7.5.changelog · Note
• http://ffmpeg.org/releases/ffmpeg-0.8.4.changelog · Note
• http://ocert.org/advisories/ocert-2011-002.html · Note