Integer signedness error in the decode_residual_block function in cavsdec.c in libavcodec in FFmpeg before 0.7.3 and 0.8.x before 0.8.2, and libav through 0.7.1, allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted Chinese AVS video (aka CAVS) file.

The remote host is affected by the vulnerability described in GLSA-201310-12 (FFmpeg: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in FFmpeg. Please review       the CVE identifiers and FFmpeg changelogs referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted media       file, possibly leading to the execution of arbitrary code with the       privileges of the user running the application or a Denial of Service.
  Workaround :

    There is no known workaround at this time.

Multiple vulnerabilities has been found and corrected in ffmpeg :

The Matroska format decoder in FFmpeg does not properly allocate memory, which allows remote attackers to execute arbitrary code via a crafted file (CVE-2011-3362, CVE-2011-3504).

cavsdec.c in libavcodec in FFmpeg allows remote attackers to cause a denial of service (incorrect write operation and application crash) via an invalid bitstream in a Chinese AVS video (aka CAVS) file, related to the decode_residual_block, check_for_slice, and cavs_decode_frame functions, a different vulnerability than CVE-2011-3362 (CVE-2011-3973).

Integer signedness error in the decode_residual_inter function in cavsdec.c in libavcodec in FFmpeg allows remote attackers to cause a denial of service (incorrect write operation and application crash) via an invalid bitstream in a Chinese AVS video (aka CAVS) file, a different vulnerability than CVE-2011-3362 (CVE-2011-3974).

Double free vulnerability in the Theora decoder in FFmpeg allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted stream (CVE-2011-3892).

FFmpeg does not properly implement the MKV and Vorbis media handlers, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors (CVE-2011-3893).

Heap-based buffer overflow in the Vorbis decoder in FFmpeg allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted stream (CVE-2011-3895).

An error within the QDM2 decoder (libavcodec/qdm2.c) can be exploited to cause a buffer overflow (CVE-2011-4351).

An integer overflow error within the 'vp3_dequant()' function (libavcodec/vp3.c) can be exploited to cause a buffer overflow (CVE-2011-4352).

Errors within the 'av_image_fill_pointers()', the 'vp5_parse_coeff()', and the 'vp6_parse_coeff()' functions can be exploited to trigger out-of-bounds reads (CVE-2011-4353).

It was discovered that Libav incorrectly handled certain malformed VMD files. If a user were tricked into opening a crafted VMD file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program (CVE-2011-4364).

It was discovered that Libav incorrectly handled certain malformed SVQ1 streams. If a user were tricked into opening a crafted SVQ1 stream file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program (CVE-2011-4579).

Multiple input validations in the decoders/ demuxers for Westwood Studios VQA, Apple MJPEG-B, Theora, Matroska, Vorbis, Sony ATRAC3, DV, NSV, files could lead to the execution of arbitrary code (CVE-2011-3929, CVE-2011-3936, CVE-2011-3937, CVE-2011-3940, CVE-2011-3945, CVE-2011-3947, CVE-2012-0853, CVE-2012-0858).

The updated packages have been upgraded to the 0.7.12 version where these issues has been corrected.

Multiple vulnerabilities has been found and corrected in ffmpeg :

The Matroska format decoder in FFmpeg does not properly allocate memory, which allows remote attackers to execute arbitrary code via a crafted file (CVE-2011-3362, CVE-2011-3504).

cavsdec.c in libavcodec in FFmpeg allows remote attackers to cause a denial of service (incorrect write operation and application crash) via an invalid bitstream in a Chinese AVS video (aka CAVS) file, related to the decode_residual_block, check_for_slice, and cavs_decode_frame functions, a different vulnerability than CVE-2011-3362 (CVE-2011-3973).

Integer signedness error in the decode_residual_inter function in cavsdec.c in libavcodec in FFmpeg allows remote attackers to cause a denial of service (incorrect write operation and application crash) via an invalid bitstream in a Chinese AVS video (aka CAVS) file, a different vulnerability than CVE-2011-3362 (CVE-2011-3974).

Double free vulnerability in the Theora decoder in FFmpeg allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted stream (CVE-2011-3892).

FFmpeg does not properly implement the MKV and Vorbis media handlers, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors (CVE-2011-3893).

Heap-based buffer overflow in the Vorbis decoder in FFmpeg allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted stream (CVE-2011-3895).

An error within the QDM2 decoder (libavcodec/qdm2.c) can be exploited to cause a buffer overflow (CVE-2011-4351).

An integer overflow error within the 'vp3_dequant()' function (libavcodec/vp3.c) can be exploited to cause a buffer overflow (CVE-2011-4352).

Errors within the 'av_image_fill_pointers()', the 'vp5_parse_coeff()', and the 'vp6_parse_coeff()' functions can be exploited to trigger out-of-bounds reads (CVE-2011-4353).

It was discovered that Libav incorrectly handled certain malformed VMD files. If a user were tricked into opening a crafted VMD file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program (CVE-2011-4364).

It was discovered that Libav incorrectly handled certain malformed SVQ1 streams. If a user were tricked into opening a crafted SVQ1 stream file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program (CVE-2011-4579).

The updated packages have been upgraded to the 0.6.5 version where these issues has been corrected.

Multiple vulnerabilities were found in FFmpeg, a multimedia player, server and encoder :

  - CVE-2011-3362     An integer signedness error in decode_residual_block     function of the Chinese AVS video (CAVS) decoder in     libavcodec can lead to denial of service (memory     corruption and application crash) or possible code     execution via a crafted CAVS file.

  - CVE-2011-3973/ CVE-2011-3974     Multiple errors in the Chinese AVS video (CAVS) decoder     can lead to denial of service (memory corruption and     application crash) via an invalid bitstream.

  - CVE-2011-3504     A memory allocation problem in the Matroska format     decoder can lead to code execution via a crafted file.

It was discovered that Libav incorrectly handled certain malformed ogg files. If a user were tricked into opening a crafted ogg file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2011-1196)

It was discovered that Libav incorrectly handled certain malformed AMV files. If a user were tricked into opening a crafted AMV file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2011-1931)

Emmanouel Kellinis discovered that Libav incorrectly handled certain malformed CAVS files. If a user were tricked into opening a crafted CAVS file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2011-3362).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that FFmpeg incorrectly handled certain malformed ogg files. If a user were tricked into opening a crafted ogg file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. This issue only affected Ubuntu 10.10.
(CVE-2011-1196)

It was discovered that FFmpeg incorrectly handled certain malformed AMV files. If a user were tricked into opening a crafted AMV file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. This issue only affected Ubuntu 10.10.
(CVE-2011-1931)

It was discovered that FFmpeg incorrectly handled certain malformed APE files. If a user were tricked into opening a crafted APE file, an attacker could cause a denial of service via application crash.
(CVE-2011-2161)

Emmanouel Kellinis discovered that FFmpeg incorrectly handled certain malformed CAVS files. If a user were tricked into opening a crafted CAVS file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2011-3362).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
70647	GLSA-201310-12 : FFmpeg: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
61951	Mandriva Linux Security Advisory : ffmpeg (MDVSA-2012:076)	Nessus	Mandriva Local Security Checks	critical
59096	Mandriva Linux Security Advisory : ffmpeg (MDVSA-2012:075)	Nessus	Mandriva Local Security Checks	high
56727	Debian DSA-2336-1 : ffmpeg - several vulnerabilities	Nessus	Debian Local Security Checks	high
56237	Ubuntu 11.04 : libav vulnerabilities (USN-1209-2)	Nessus	Ubuntu Local Security Checks	high
56236	Ubuntu 10.04 LTS / 10.10 : ffmpeg vulnerabilities (USN-1209-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2011-3362

high

Tenable Plugins

critical

critical

high

high

high

high