CVE-2011-3974 — Ffmpeg vulnerability

4 documents4 sources
Severity
5.0MEDIUMNVD
OSV6.8
EPSS
1.4%
top 19.68%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
FfmpegDebian Ffmpeg
Timeline
PublishedOct 2
Latest updateMay 17

Description

Integer signedness error in the decode_residual_inter function in cavsdec.c in libavcodec in FFmpeg before 0.7.4 and 0.8.x before 0.8.3 allows remote attackers to cause a denial of service (incorrect write operation and application crash) via an invalid bitstream in a Chinese AVS video (aka CAVS) file, a different vulnerability than CVE-2011-3362.

CVSS vector

AV:N/AC:L/C:N/I:N/A:PExploitability: 10.0 | Impact: 2.9

Affected Packages3 packages

▶debiandebian/ffmpeg< ffmpeg 7:2.4.1-1 (bookworm)
▶Debianffmpeg/ffmpeg< 7:2.4.1-1+3
▶NVDffmpeg/ffmpeg0.7.3+27

🔴Vulnerability Details

2
GHSA
GHSA-7678-79q4-rmhw: Integer signedness error in the decode_residual_inter function in cavsdec↗2022-05-17
▶
OSV
CVE-2011-3974: Integer signedness error in the decode_residual_inter function in cavsdec↗2011-10-02
▶

📋Vendor Advisories

1
Debian
CVE-2011-3974: ffmpeg - Integer signedness error in the decode_residual_inter function in cavsdec.c in l...↗2011
▶