Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

CVE-2011-4352

Published: 25 November 2011

Integer overflow in the vp3_dequant function in the VP3 decoder (vp3.c) in libavcodec in FFmpeg 0.5.x before 0.5.7, 0.6.x before 0.6.4, 0.7.x before 0.7.9, and 0.8.x before 0.8.8; and in Libav 0.5.x before 0.5.6, 0.6.x before 0.6.4, and 0.7.x before 0.7.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted VP3 stream, which triggers a buffer overflow.

Notes

AuthorNote
mdeslaur
ffmpeg-extra in multiverse needs to have matching version
libav-extra is built with tarball produced by libav package
libav doesn't seem to have equivalent patch yet as of 2012-12-22
See thread: http://thread.gmane.org/gmane.comp.video.libav.devel/15121
this fixes NGS00145

Priority

Medium

Status

Package Release Status
ffmpeg
Launchpad, Ubuntu, Debian
hardy Ignored
(end of life)
lucid Not vulnerable
(code not present)
maverick
Released (4:0.6-2ubuntu6.3)
natty Does not exist

oneiric Does not exist

upstream Needs triage

Patches:
upstream: http://git.videolan.org/?p=ffmpeg.git;a=commit;h=eef5c35b4352ec49ca41f6198bee8a976b1f81e5

ffmpeg-extra
Launchpad, Ubuntu, Debian
hardy Does not exist

lucid Not vulnerable
(code not present)
maverick
Released (4:0.6-2ubuntu3.3)
natty Does not exist

oneiric Does not exist

upstream Needs triage

libav
Launchpad, Ubuntu, Debian
hardy Does not exist

lucid Does not exist

maverick Does not exist

natty
Released (4:0.6.4-0ubuntu0.11.04.1)
oneiric
Released (4:0.7.3-0ubuntu0.11.10.1)
upstream
Released (0.7.3)
Patches:

upstream: http://git.libav.org/?p=libav.git;a=commit;h=8b94df0f2047e9728cb872adc9e64557b7a5152f
libav-extra
Launchpad, Ubuntu, Debian
hardy Does not exist

lucid Does not exist

maverick Does not exist

natty
Released (4:0.6.4-1ubuntu1)
oneiric
Released (4:0.7.3ubuntu0.11.10.1)
upstream Needs triage