NULL pointer dereference in Libav and FFmpeg - CVE-2011-3929

Vulnerability identifier: #VU43707

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2011-3929

CWE-ID: CWE-476

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error. A remote attacker can trigger denial of service conditions via a crafted DV file.

Libav
FFmpeg
Gentoo Linux
Ubuntu
libavcodec52 (Ubuntu package)
libavformat52 (Ubuntu package)
libavcodec53 (Ubuntu package)
libavformat53 (Ubuntu package)

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

libavcodec52 (Ubuntu package) - addressed in versions 4:0.5.9-0ubuntu0.10.04.1, 4:0.6.6-0ubuntu0.11.04.1
libavformat52 (Ubuntu package) - addressed in versions 4:0.5.9-0ubuntu0.10.04.1, 4:0.6.6-0ubuntu0.11.04.1
libavcodec53 (Ubuntu package) - addressed in versions 4:0.7.6-0ubuntu0.11.10.1, 4:0.8.3-0ubuntu0.12.04.1
libavformat53 (Ubuntu package) - addressed in versions 4:0.7.6-0ubuntu0.11.10.1, 4:0.8.3-0ubuntu0.12.04.1

• http://ffmpeg.org/
• http://git.libav.org/?p=libav.git;a=commit;h=635bcfccd439480003b74a665b5aa7c872c1ad6b
• http://git.libav.org/?p=libav.git;a=commitdiff;h=5a396bb3a66a61a68b80f2369d0249729bf85e04
• http://libav.org/
• http://secunia.com/advisories/49089
• http://www.debian.org/security/2012/dsa-2471
• http://www.ubuntu.com/usn/USN-1479-1

• Gentoo update for Libav
• Ubuntu update for ffmpeg
• Ubuntu update for libav