CVE-2011-3929 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Ffmpeg

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer6 documents5 sources
Severity
6.8MEDIUMNVD
EPSS
2.9%
top 13.63%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
FfmpegDebian FfmpegLibav
Timeline
PublishedAug 20
Latest updateMay 17

Description

The avpriv_dv_produce_packet function in libavcodec in FFmpeg 0.7.x before 0.7.12 and 0.8.x before 0.8.11 and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.5, and 0.8.x before 0.8.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) and possibly execute arbitrary code via a crafted DV file.

CVSS vector

AV:N/AC:M/C:P/I:P/A:PExploitability: 8.6 | Impact: 6.4

Affected Packages4 packages

▶debiandebian/ffmpeg< ffmpeg 7:2.4.1-1 (bookworm)
▶Debianffmpeg/ffmpeg< 7:2.4.1-1+3
▶NVDlibav/libav20 versions+19
▶NVDffmpeg/ffmpeg12 versions+11

🔴Vulnerability Details

2
GHSA
GHSA-vfm7-qg4x-5fg2: The avpriv_dv_produce_packet function in libavcodec in FFmpeg 0↗2022-05-17
▶
OSV
CVE-2011-3929: The avpriv_dv_produce_packet function in libavcodec in FFmpeg 0↗2012-08-20
▶

📋Vendor Advisories

3
Ubuntu
FFmpeg vulnerabilities↗2012-06-18
▶
Ubuntu
Libav vulnerabilities↗2012-06-18
▶
Debian
CVE-2011-3929: ffmpeg - The avpriv_dv_produce_packet function in libavcodec in FFmpeg 0.7.x before 0.7.1...↗2011
▶