CVE-2011-3936 — Improper Input Validation in Ffmpeg

CWE-20 — Improper Input Validation6 documents5 sources
Severity
4.3MEDIUMNVD
EPSS
1.0%
top 22.74%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
FfmpegDebian FfmpegLibav
Timeline
PublishedAug 20
Latest updateMay 17

Description

The dv_extract_audio function in libavcodec in FFmpeg 0.7.x before 0.7.12 and 0.8.x before 0.8.11 and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.5, and 0.8.x before 0.8.1 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted DV file.

CVSS vector

AV:N/AC:M/C:N/I:N/A:PExploitability: 8.6 | Impact: 2.9

Affected Packages4 packages

▶debiandebian/ffmpeg< ffmpeg 7:2.4.1-1 (bookworm)
▶Debianffmpeg/ffmpeg< 7:2.4.1-1+3
▶NVDlibav/libav20 versions+19
▶NVDffmpeg/ffmpeg18 versions+17

🔴Vulnerability Details

2
GHSA
GHSA-xjw3-xjhw-33xq: The dv_extract_audio function in libavcodec in FFmpeg 0↗2022-05-17
▶
OSV
CVE-2011-3936: The dv_extract_audio function in libavcodec in FFmpeg 0↗2012-08-20
▶

📋Vendor Advisories

3
Ubuntu
FFmpeg vulnerabilities↗2012-06-18
▶
Ubuntu
Libav vulnerabilities↗2012-06-18
▶
Debian
CVE-2011-3936: ffmpeg - The dv_extract_audio function in libavcodec in FFmpeg 0.7.x before 0.7.12 and 0....↗2011
▶