CVE-2011-3946 — Infinite Loop in Ffmpeg

CWE-3994 documents4 sources
Severity
6.8MEDIUMNVD
EPSS
0.6%
top 31.00%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
FfmpegDebian Ffmpeg
Timeline
PublishedDec 9
Latest updateMay 17

Description

The ff_h264_decode_sei function in libavcodec/h264_sei.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact via crafted Supplemental enhancement information (SEI) data, which triggers an infinite loop.

CVSS vector

AV:N/AC:M/C:P/I:P/A:PExploitability: 8.6 | Impact: 6.4

Affected Packages3 packages

▶debiandebian/ffmpeg< ffmpeg 7:2.4.1-1 (bookworm)
▶Debianffmpeg/ffmpeg< 7:2.4.1-1+3
▶NVDffmpeg/ffmpeg0.9.1+50

🔴Vulnerability Details

2
GHSA
GHSA-wwfj-h5pc-cmm2: The ff_h264_decode_sei function in libavcodec/h264_sei↗2022-05-17
▶
OSV
CVE-2011-3946: The ff_h264_decode_sei function in libavcodec/h264_sei↗2013-12-09
▶

📋Vendor Advisories

1
Debian
CVE-2011-3946: ffmpeg - The ff_h264_decode_sei function in libavcodec/h264_sei.c in FFmpeg before 0.10 a...↗2011
▶