CVE-2011-4352: Buffer Overflow

Published Aug 20, 2012

Updated

Integer overflow in the vp3dequant function in the VP3 decoder (vp3.c) in libavcodec in FFmpeg 0.5.x before 0.5.7, 0.6.x before 0.6.4, 0.7.x before 0.7.9, and 0.8.x before 0.8.8; and in Libav 0.5.x before 0.5.6, 0.6.x before 0.6.4, and 0.7.x before 0.7.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted VP3 stream, which triggers a buffer overflow.

Affected Software

42 affected components

Libav Libav=0.5

Libav Libav=0.5.1

Libav Libav=0.5.2

Libav Libav=0.5.3

Libav Libav=0.5.4

Libav Libav=0.5.5

Libav Libav=0.6

Libav Libav=0.6.1

Libav Libav=0.6.2

Libav Libav=0.6.3

Libav Libav=0.7

Libav Libav=0.7-beta1

Libav Libav=0.7-beta2

Libav Libav=0.7.1

FFmpeg FFmpeg=0.5

FFmpeg FFmpeg=0.5.1

FFmpeg FFmpeg=0.5.2

FFmpeg FFmpeg=0.5.3

FFmpeg FFmpeg=0.5.4

FFmpeg FFmpeg=0.5.4.5

FFmpeg FFmpeg=0.5.4.6

FFmpeg FFmpeg=0.6

FFmpeg FFmpeg=0.6.1

FFmpeg FFmpeg=0.6.2

FFmpeg FFmpeg=0.6.3

FFmpeg FFmpeg=0.7

FFmpeg FFmpeg=0.7.1

FFmpeg FFmpeg=0.7.2

FFmpeg FFmpeg=0.7.3

FFmpeg FFmpeg=0.7.4

FFmpeg FFmpeg=0.7.5

FFmpeg FFmpeg=0.7.6

FFmpeg FFmpeg=0.7.7

FFmpeg FFmpeg=0.7.8

FFmpeg FFmpeg=0.8.0

FFmpeg FFmpeg=0.8.1

FFmpeg FFmpeg=0.8.2

FFmpeg FFmpeg=0.8.5

FFmpeg FFmpeg=0.8.5.3

FFmpeg FFmpeg=0.8.5.4

FFmpeg FFmpeg=0.8.6

FFmpeg FFmpeg=0.8.7

Event History

Aug 20, 2012

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2011-4352?

CVE-2011-4352 is considered to have a medium severity level as it allows remote attackers to cause a denial of service.

How do I fix CVE-2011-4352?

To fix CVE-2011-4352, you should upgrade to a patched version of FFmpeg or Libav, specifically versions 0.5.7, 0.6.4, 0.7.9, and 0.8.8 or higher.

What software is affected by CVE-2011-4352?

CVE-2011-4352 affects multiple versions of FFmpeg and Libav, specifically versions prior to 0.5.7, 0.6.4, 0.7.9, and 0.8.8.

What type of vulnerability is CVE-2011-4352?

CVE-2011-4352 is an integer overflow vulnerability found in the VP3 decoder.

Can CVE-2011-4352 lead to remote code execution?

No, CVE-2011-4352 specifically allows for denial of service, not remote code execution.