CVE-2011-3945 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Ffmpeg

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer4 documents4 sources
Severity
6.8MEDIUMNVD
EPSS
2.3%
top 15.12%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
FfmpegLibavDebian Ffmpeg
Timeline
PublishedAug 20
Latest updateMay 17

Description

The decode_frame function in the KVG1 decoder (kgv1dec.c) in libavcodec in FFmpeg 0.7.x before 0.7.12 and 0.8.x before 0.8.11, and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.5, and 0.8.x before 0.8.1, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted media file.

CVSS vector

AV:N/AC:M/C:P/I:P/A:PExploitability: 8.6 | Impact: 6.4

Affected Packages3 packages

▶NVDlibav/libav20 versions+19
▶NVDffmpeg/ffmpeg17 versions+16
▶debiandebian/ffmpeg

🔴Vulnerability Details

1
GHSA
GHSA-g562-7r9w-rhjc: The decode_frame function in the KVG1 decoder (kgv1dec↗2022-05-17
▶

📋Vendor Advisories

2
Ubuntu
Libav vulnerabilities↗2012-06-18
▶
Debian
CVE-2011-3945: ffmpeg - The decode_frame function in the KVG1 decoder (kgv1dec.c) in libavcodec in FFmpe...↗2011
▶