Buffer overflow in FFmpeg - CVE-2011-4351

Vulnerability identifier: #VU42269

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2011-4351

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Buffer overflow in FFmpeg before 0.5.6, 0.6.x before 0.6.4, 0.7.x before 0.7.8, and 0.8.x before 0.8.8 allows remote attackers to execute arbitrary code via unspecified vectors.

FFmpeg
Ubuntu
libavformat52 (Ubuntu package)
libavcodec52 (Ubuntu package)
libavcodec53 (Ubuntu package)
libavformat53 (Ubuntu package)

Install update from vendor's website.

libavformat52 (Ubuntu package) - addressed in versions 4:0.5.1-1ubuntu1.3, 4:0.6-2ubuntu6.3, 4:0.6.4-0ubuntu0.11.04.1
libavcodec52 (Ubuntu package) - addressed in versions 4:0.5.1-1ubuntu1.3, 4:0.6-2ubuntu6.3, 4:0.6.4-0ubuntu0.11.04.1
libavcodec53 (Ubuntu package) - update to 4:0.7.3-0ubuntu0.11.10.1
libavformat53 (Ubuntu package) - update to 4:0.7.3-0ubuntu0.11.10.1

• http://seclists.org/bugtraq/2011/Nov/145
• http://www.ffmpeg.org/security.html

• Buffer overflow in ffmpeg.sourceforge.net FFmpeg
• Ubuntu update for libav
• Ubuntu update for ffmpeg