Out-of-bounds read in Libav and FFmpeg - CVE-2011-3936

Vulnerability identifier: #VU43708

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2011-3936

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to perform denial of service (DoS) attack.

The vulnerability exists due to a boundary condition within the libavcodec function in FFmpeg 0.7.x before 0.7.12 and 0.8.x before 0.8.11 and file. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger out-of-bounds read error and crash the affected application.

Libav
FFmpeg
Gentoo Linux
Ubuntu
libavcodec52 (Ubuntu package)
libavformat52 (Ubuntu package)
libavcodec53 (Ubuntu package)
libavformat53 (Ubuntu package)

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

libavcodec52 (Ubuntu package) - addressed in versions 4:0.5.9-0ubuntu0.10.04.1, 4:0.6.6-0ubuntu0.11.04.1
libavformat52 (Ubuntu package) - addressed in versions 4:0.5.9-0ubuntu0.10.04.1, 4:0.6.6-0ubuntu0.11.04.1
libavcodec53 (Ubuntu package) - addressed in versions 4:0.7.6-0ubuntu0.11.10.1, 4:0.8.3-0ubuntu0.12.04.1
libavformat53 (Ubuntu package) - addressed in versions 4:0.7.6-0ubuntu0.11.10.1, 4:0.8.3-0ubuntu0.12.04.1

• http://ffmpeg.org/
• http://git.libav.org/?p=libav.git;a=commit;h=635bcfccd439480003b74a665b5aa7c872c1ad6b
• http://git.libav.org/?p=libav.git;a=commitdiff;h=2d1c0dea5f6b91bec7f5fa53ec050913d851e366
• http://libav.org/
• http://secunia.com/advisories/49089
• http://www.debian.org/security/2012/dsa-2471
• http://www.ubuntu.com/usn/USN-1479-1

• Gentoo update for Libav
• Ubuntu update for ffmpeg
• Ubuntu update for libav