Multiple buffer overflows in vorbis_dec.c in the Vorbis decoder in FFmpeg, as used in Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344, allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a crafted WebM file, related to buffers for (1) the channel floor and (2) the channel residue.

Several vulnerabilities have been discovered in FFmpeg, a multimedia player, server and encoder. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2010-3908     FFmpeg before 0.5.4, allows remote attackers to cause a     denial of service (memory corruption and application     crash) or possibly execute arbitrary code via a     malformed WMV file.

  - CVE-2010-4704     libavcodec/vorbis_dec.c in the Vorbis decoder in FFmpeg     allows remote attackers to cause a denial of service     (application crash) via a crafted Ogg file, related to     the vorbis_floor0_decode function.

  - CVE-2011-0480     Multiple buffer overflows in vorbis_dec.c in the Vorbis     decoder in FFmpeg allow remote attackers to cause a     denial of service (memory corruption and application     crash) or possibly have unspecified other impact via a     crafted WebM file, related to buffers for the channel     floor and the channel residue.

  - CVE-2011-0722     FFmpeg allows remote attackers to cause a denial of     service (heap memory corruption and application crash)     or possibly execute arbitrary code via a malformed     RealMedia file.

Cesar Bernardini and Felipe Andres Manzano discovered that FFmpeg incorrectly handled certain malformed flic files. If a user were tricked into opening a crafted flic file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. This issue only affected Ubuntu 8.04 LTS, 9.10 and 10.04 LTS. (CVE-2010-3429)

Dan Rosenberg discovered that FFmpeg incorrectly handled certain malformed wmv files. If a user were tricked into opening a crafted wmv file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. This issue only affected Ubuntu 8.04 LTS, 9.10 and 10.04 LTS. (CVE-2010-3908)

It was discovered that FFmpeg incorrectly handled certain malformed ogg files. If a user were tricked into opening a crafted ogg file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2010-4704)

It was discovered that FFmpeg incorrectly handled certain malformed WebM files. If a user were tricked into opening a crafted WebM file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2011-0480)

Dan Rosenberg discovered that FFmpeg incorrectly handled certain malformed RealMedia files. If a user were tricked into opening a crafted RealMedia file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. This issue only affected Ubuntu 8.04 LTS, 9.10 and 10.04 LTS. (CVE-2011-0722)

Dan Rosenberg discovered that FFmpeg incorrectly handled certain malformed VC1 files. If a user were tricked into opening a crafted VC1 file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2011-0723).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities has been identified and fixed in ffmpeg :

oggparsevorbis.c in FFmpeg 0.5 does not properly perform certain pointer arithmetic, which might allow remote attackers to obtain sensitive memory contents and cause a denial of service via a crafted file that triggers an out-of-bounds read. (CVE-2009-4632)

vorbis_dec.c in FFmpeg 0.5 uses an assignment operator when a comparison operator was intended, which might allow remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted file that modifies a loop counter and triggers a heap-based buffer overflow. (CVE-2009-4633)

Multiple integer underflows in FFmpeg 0.5 allow remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted file that (1) bypasses a validation check in vorbis_dec.c and triggers a wraparound of the stack pointer, or (2) access a pointer from out-of-bounds memory in mov.c, related to an elst tag that appears before a tag that creates a stream. (CVE-2009-4634)

FFmpeg 0.5 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted MOV container with improperly ordered tags that cause (1) mov.c and (2) utils.c to use inconsistent codec types and identifiers, which causes the mp3 decoder to process a pointer for a video structure, leading to a stack-based buffer overflow. (CVE-2009-4635)

FFmpeg 0.5 allows remote attackers to cause a denial of service (hang) via a crafted file that triggers an infinite loop. (CVE-2009-4636)

The av_rescale_rnd function in the AVI demuxer in FFmpeg 0.5 allows remote attackers to cause a denial of service (crash) via a crafted AVI file that triggers a divide-by-zero error. (CVE-2009-4639)

Array index error in vorbis_dec.c in FFmpeg 0.5 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted Vorbis file that triggers an out-of-bounds read.
(CVE-2009-4640)

flicvideo.c in libavcodec 0.6 and earlier in FFmpeg, as used in MPlayer and other products, allows remote attackers to execute arbitrary code via a crafted flic file, related to an arbitrary offset dereference vulnerability. (CVE-2010-3429)

Fix memory corruption in WMV parsing (CVE-2010-3908)

libavcodec/vorbis_dec.c in the Vorbis decoder in FFmpeg 0.6.1 and earlier allows remote attackers to cause a denial of service (application crash) via a crafted .ogg file, related to the vorbis_floor0_decode function. (CVE-2010-4704)

Multiple buffer overflows in vorbis_dec.c in the Vorbis decoder in FFmpeg, as used in Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344, allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a crafted WebM file, related to buffers for (1) the channel floor and (2) the channel residue. (CVE-2011-0480)

Fix heap corruption crashes (CVE-2011-0722)

Fix invalid reads in VC-1 decoding (CVE-2011-0723)

And several additional vulnerabilities originally discovered by Google Chrome developers were also fixed with this advisory.

The updated packages have been patched to correct these issues.

The version of Google Chrome installed on the remote host is earlier than 8.0.552.237.  Such versions are reportedly affected by multiple vulnerabilities :

  - A browser crash exists in extensions notification     handling. (Issue #58053)

  - Bad pointer handling exists in node iteration.
    (Issue #65764)

  - Multiple crashes exist when printing multi-page PDFs.
    (Issue #66334)

  - A stale pointer exists with CSS + canvas. (Issue #66560)

  - A stale pointer exists with CSS + cursors.
    (Issue #66748)

  - A use-after-free error exists in PDF handling.
    (Issue #67100)

  - A stack corruption error exists after PDF out-of-memory     conditions. (Issue #67208)

  - A bad memory access issue exists when handling     mismatched video frame sizes. (Issue #67303)

  - A stale pointer exists with SVG use element.
    (Issue #67363)

  - An uninitialized pointer exists in the browser which is     triggered by rogue extensions. (Issue #67393)

  - Multiple buffer overflows exist in the Vorbis decoder.
    (Issue #68115)

  - A buffer overflow exists in PDF shading. (Issue #68170)

  - A bad cast exists in anchor handling. (Issue #68178)

  - A bad cast exists in video handling. (Issue #68181)

  - A stale rendering node exists after DOM node removal.
    (Issue #68439)

  - A stale pointer exists in speech handling.
    (Issue #68666)

Versions of Google Chrome earlier than 8.0.552.237 are potentially affected by multiple vulnerabilities :

  - A browser crash exists in extensions notification handling. (58053)

  - Bad pointer handling exists in node iteration. (65764)

  - Multiple crashes exist when printing multi-page PDFs. (66334)

  - A stale pointer exists with CSS + canvas. (66560)

  - A stale pointer exists with CSS + cursors. (66748)

  - A use after free error exists in PDF handling. (67100)

  - A stack corruption error exists after PDF out-of-memory conditions. (67208)

  - A bad memory access issue exists when handling mismatched video frame sizes. (67303)

  -A stale pointer exists with SVG use elements. (67363)

  - An uninitialized pointer exists in the browser which is triggered by rogue extensions. (67393)

  - Multiple buffer overflows exists in the Vorbis decoder. (68115)

  - A buffer overflow exists in PDF shading. (68170)

  - A bad cast exists in anchor handling. (68178)

  - A bad cast exists in video handling. (68181)

  - A stale rendering node exists after DOM node removal. (68439)

  - A stale pointer exists in speech handling. (68666)

ID	Name	Product	Family	Severity
56144	Debian DSA-2306-1 : ffmpeg - several vulnerabilities	Nessus	Debian Local Security Checks	high
53296	Ubuntu 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : ffmpeg vulnerabilities (USN-1104-1)	Nessus	Ubuntu Local Security Checks	high
53273	Mandriva Linux Security Advisory : ffmpeg (MDVSA-2011:061)	Nessus	Mandriva Local Security Checks	critical
51511	Google Chrome < 8.0.552.237 Multiple Vulnerabilities	Nessus	Windows	high
800941	Google Chrome < 8.0.552.237 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high

Detections

Analytics

CVE-2011-0480

high

Tenable Plugins

high

high

critical

high

high