Buffer overflow in Libav and FFmpeg - CVE-2011-3951

Vulnerability identifier: #VU43701

CSH Severity: Medium

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2011-3951

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The dpcm_decode_frame function in dpcm.c in libavcodec in FFmpeg before 0.10 and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.6, and 0.8.x before 0.8.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted stereo stream in a media file.

Libav
FFmpeg
Gentoo Linux
Ubuntu
libavcodec52 (Ubuntu package)
libavformat52 (Ubuntu package)
libavcodec53 (Ubuntu package)
libavformat53 (Ubuntu package)

Install update from vendor's website.

libavcodec52 (Ubuntu package) - addressed in versions 4:0.5.9-0ubuntu0.10.04.1, 4:0.6.6-0ubuntu0.11.04.1
libavformat52 (Ubuntu package) - addressed in versions 4:0.5.9-0ubuntu0.10.04.1, 4:0.6.6-0ubuntu0.11.04.1
libavcodec53 (Ubuntu package) - addressed in versions 4:0.7.6-0ubuntu0.11.10.1, 4:0.8.3-0ubuntu0.12.04.1
libavformat53 (Ubuntu package) - addressed in versions 4:0.7.6-0ubuntu0.11.10.1, 4:0.8.3-0ubuntu0.12.04.1

• http://ffmpeg.org/
• http://git.libav.org/?p=libav.git;a=commit;h=ce7aee9b733134649a6ce2fa743e51733f33e67e
• http://libav.org/
• http://www.debian.org/security/2012/dsa-2494
• http://www.ubuntu.com/usn/USN-1479-1

• Gentoo update for Libav
• Ubuntu update for ffmpeg
• Ubuntu update for libav