[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 10 Aug 2011 15:19:39 +0200
From: Daniele Bianco <danbia@...rt.org>
To: oss-security@...ts.openwall.com, ocert-announce@...ts.ocert.org,
bugtraq@...urityfocus.com
Subject: [oCERT-2011-002] libavcodec insufficient boundary check
#2011-002 libavcodec insufficient boundary check
Description:
The libavcodec library, an open source video encoding/decoding library part
of the FFmpeg and Libav projects, performs insufficient boundary check
against a buffer index. The missing check can result in arbitrary read/write
of data outside a destination buffer boundaries.
The vulnerability affects the Chinese AVS video (CAVS) file format decoder,
specially crafted CAVS files may lead to arbitrary code execution during
decoding.
Affected version:
FFmpeg <= 0.7.2, <= 0.8.1
Libav <= 0.7.1
The following packages were identified as affected as they statically
include libavcodec in their own packages.
MPlayer <= 1.0_rc4
Fixed version:
FFmpeg >= 0.7.3, >= 0.8.2
Libav, N/A
MPlayer, N/A
Credit: vulnerability report received from Emmanouel Kellinis.
CVE: N/A
Timeline:
2011-07-14: vulnerability report received
2011-07-15: contacted ffmpeg maintainers
2011-07-15: ffmpeg maintainer confirms the issue, preliminary patch is
provided
2011-07-21: patch approved by reporter
2011-07-23: contacted affected vendors
2011-08-10: advisory release
Permalink:
http://www.ocert.org/advisories/ocert-2011-002.html
--
Daniele Bianco Open Source Computer Security Incident Response Team
<danbia@...rt.org> http://www.ocert.org
GPG Key 0x9544A497
GPG Key fingerprint = 88A7 43F4 F28F 1B9D 6F2D 4AC5 AE75 822E 9544 A497
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
