Buffer overflow in Libav and FFmpeg - CVE-2011-3947

Vulnerability identifier: #VU43700

CSH Severity: Medium

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2011-3947

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Buffer overflow in mjpegbdec.c in libavcodec in FFmpeg 0.7.x before 0.7.12 and 0.8.x before 0.8.11, and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.5, and 0.8.x before 0.8.1, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted MJPEG-B file.

Libav
FFmpeg
Gentoo Linux
Ubuntu
libavcodec52 (Ubuntu package)
libavformat52 (Ubuntu package)
libavcodec53 (Ubuntu package)
libavformat53 (Ubuntu package)

Install update from vendor's website.

libavcodec52 (Ubuntu package) - addressed in versions 4:0.5.9-0ubuntu0.10.04.1, 4:0.6.6-0ubuntu0.11.04.1
libavformat52 (Ubuntu package) - addressed in versions 4:0.5.9-0ubuntu0.10.04.1, 4:0.6.6-0ubuntu0.11.04.1
libavcodec53 (Ubuntu package) - addressed in versions 4:0.7.6-0ubuntu0.11.10.1, 4:0.8.3-0ubuntu0.12.04.1
libavformat53 (Ubuntu package) - addressed in versions 4:0.7.6-0ubuntu0.11.10.1, 4:0.8.3-0ubuntu0.12.04.1

• http://ffmpeg.org/
• http://git.libav.org/?p=libav.git;a=commit;h=b57d262412204e54a7ef8fa1b23ff4dcede622e5
• http://git.videolan.org/?p=ffmpeg.git;a=commit;h=b57d262412204e54a7ef8fa1b23ff4dcede622e5
• http://libav.org/
• http://secunia.com/advisories/49089
• http://www.debian.org/security/2012/dsa-2471
• http://www.ubuntu.com/usn/USN-1479-1

• Gentoo update for Libav
• Ubuntu update for ffmpeg
• Ubuntu update for libav