CVE-2011-3952: Input Validation

Q: What is the severity of CVE-2011-3952?

CVE-2011-3952 is classified as a denial of service vulnerability, which could potentially lead to application crashes.

Q: How do I fix CVE-2011-3952?

To fix CVE-2011-3952, upgrade FFmpeg or Libav to versions that are above the vulnerable versions specified in the CVE details.

Q: What versions of FFmpeg are affected by CVE-2011-3952?

FFmpeg versions before 0.10 and specific vulnerable versions up to 0.9.1 are affected by CVE-2011-3952.

Q: What versions of Libav are affected by CVE-2011-3952?

Libav versions before 0.5.9, 0.6.6, 0.7.6, and 0.8.1 are affected by CVE-2011-3952.

Q: What type of attack can exploit CVE-2011-3952?

CVE-2011-3952 can be exploited by remote attackers to cause application crashes or potentially execute arbitrary code.

Published Aug 20, 2012

Updated

The decodeinit function in kmvc.c in libavcodec in FFmpeg before 0.10 and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.6, and 0.8.x before 0.8.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large palette size in a KMVC encoded file.

Affected Software

62 affected components

FFmpeg FFmpeg<=0.9.1

FFmpeg FFmpeg=0.3

FFmpeg FFmpeg=0.3.1

FFmpeg FFmpeg=0.3.2

FFmpeg FFmpeg=0.3.3

FFmpeg FFmpeg=0.3.4

FFmpeg FFmpeg=0.4.0

FFmpeg FFmpeg=0.4.2

FFmpeg FFmpeg=0.4.3

FFmpeg FFmpeg=0.4.4

FFmpeg FFmpeg=0.4.5

FFmpeg FFmpeg=0.4.6

FFmpeg FFmpeg=0.4.7

FFmpeg FFmpeg=0.4.8

FFmpeg FFmpeg=0.4.9

FFmpeg FFmpeg=0.4.9-pre1

FFmpeg FFmpeg=0.5

FFmpeg FFmpeg=0.5.1

FFmpeg FFmpeg=0.5.2

FFmpeg FFmpeg=0.5.3

FFmpeg FFmpeg=0.5.4

FFmpeg FFmpeg=0.6

FFmpeg FFmpeg=0.6.1

FFmpeg FFmpeg=0.6.2

FFmpeg FFmpeg=0.7

FFmpeg FFmpeg=0.7.1

FFmpeg FFmpeg=0.7.2

FFmpeg FFmpeg=0.7.3

FFmpeg FFmpeg=0.7.6

FFmpeg FFmpeg=0.7.7

FFmpeg FFmpeg=0.7.8

FFmpeg FFmpeg=0.7.9

FFmpeg FFmpeg=0.7.11

FFmpeg FFmpeg=0.7.12

FFmpeg FFmpeg=0.8.0

FFmpeg FFmpeg=0.8.1

FFmpeg FFmpeg=0.8.2

FFmpeg FFmpeg=0.8.5

FFmpeg FFmpeg=0.8.6

FFmpeg FFmpeg=0.8.7

FFmpeg FFmpeg=0.8.8

FFmpeg FFmpeg=0.8.10

FFmpeg FFmpeg=0.8.11

FFmpeg FFmpeg=0.9

Libav Libav=0.5

Libav Libav=0.5.1

Libav Libav=0.5.2

Libav Libav=0.5.3

Libav Libav=0.6

Libav Libav=0.6.1

Libav Libav=0.6.2

Libav Libav=0.6.3

Libav Libav=0.7

Libav Libav=0.7-beta1

Libav Libav=0.7-beta2

Libav Libav=0.7.1

Libav Libav=0.7.2

Libav Libav=0.7.3

Libav Libav=0.7.4

Libav Libav=0.7.5

Libav Libav=0.8

Libav Libav=0.8-beta2

Remediation

Patch Available

http://git.libav.org/?p=libav.git;a=commit;h=386741f887714d3e46c9e8fe577e326a7964037b

Event History

Aug 20, 2012

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2011-3952?

CVE-2011-3952 is classified as a denial of service vulnerability, which could potentially lead to application crashes.

How do I fix CVE-2011-3952?