CVE-2011-3973 — Ffmpeg vulnerability

5 documents5 sources
Severity
5.0MEDIUMNVD
OSV6.8
EPSS
1.4%
top 19.68%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
FfmpegDebian Ffmpeg
Timeline
PublishedOct 2
Latest updateMay 17

Description

cavsdec.c in libavcodec in FFmpeg before 0.7.4 and 0.8.x before 0.8.3 allows remote attackers to cause a denial of service (incorrect write operation and application crash) via an invalid bitstream in a Chinese AVS video (aka CAVS) file, related to the decode_residual_block, check_for_slice, and cavs_decode_frame functions, a different vulnerability than CVE-2011-3362.

CVSS vector

AV:N/AC:L/C:N/I:N/A:PExploitability: 10.0 | Impact: 2.9

Affected Packages3 packages

▶debiandebian/ffmpeg< ffmpeg 7:2.4.1-1 (bookworm)
▶Debianffmpeg/ffmpeg< 7:2.4.1-1+3
▶NVDffmpeg/ffmpeg0.7.3+27

🔴Vulnerability Details

2
GHSA
GHSA-v2j8-vr47-x5g5: cavsdec↗2022-05-17
▶
OSV
CVE-2011-3973: cavsdec↗2011-10-02
▶

💥Exploits & PoCs

1
Exploit-DB
Microsoft WMI Administration Tools - ActiveX Buffer Overflow (Metasploit)↗2011-01-14
▶

📋Vendor Advisories

1
Debian
CVE-2011-3973: ffmpeg - cavsdec.c in libavcodec in FFmpeg before 0.7.4 and 0.8.x before 0.8.3 allows rem...↗2011
▶