CVE-2011-4352 — Ffmpeg vulnerability

CWE-1895 documents4 sources
Severity
6.8MEDIUMNVD
EPSS
4.5%
top 10.82%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
FfmpegLibavDebian Ffmpeg
Timeline
PublishedAug 20
Latest updateMay 17

Description

Integer overflow in the vp3_dequant function in the VP3 decoder (vp3.c) in libavcodec in FFmpeg 0.5.x before 0.5.7, 0.6.x before 0.6.4, 0.7.x before 0.7.9, and 0.8.x before 0.8.8; and in Libav 0.5.x before 0.5.6, 0.6.x before 0.6.4, and 0.7.x before 0.7.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted VP3 stream, which triggers a buffer overflow.

CVSS vector

AV:N/AC:M/C:P/I:P/A:PExploitability: 8.6 | Impact: 6.4

Affected Packages3 packages

▶NVDlibav/libav12 versions+11
▶NVDffmpeg/ffmpeg28 versions+27
▶debiandebian/ffmpeg

🔴Vulnerability Details

1
GHSA
GHSA-f7vh-hgm6-q6h3: Integer overflow in the vp3_dequant function in the VP3 decoder (vp3↗2022-05-17
▶

📋Vendor Advisories

3
Ubuntu
Libav vulnerabilities↗2012-01-17
▶
Ubuntu
FFmpeg vulnerabilities↗2012-01-05
▶
Debian
CVE-2011-4352: ffmpeg - Integer overflow in the vp3_dequant function in the VP3 decoder (vp3.c) in libav...↗2011
▶