Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 10 Aug 2011 15:19:39 +0200
From: Daniele Bianco <>
Subject: [oCERT-2011-002] libavcodec insufficient boundary check

#2011-002 libavcodec insufficient boundary check


The libavcodec library, an open source video encoding/decoding library part
of the FFmpeg and Libav projects, performs insufficient boundary check
against a buffer index. The missing check can result in arbitrary read/write
of data outside a destination buffer boundaries.

The vulnerability affects the Chinese AVS video (CAVS) file format decoder,
specially crafted CAVS files may lead to arbitrary code execution during

Affected version:

FFmpeg <= 0.7.2, <= 0.8.1

Libav <= 0.7.1

The following packages were identified as affected as they statically
include libavcodec in their own packages.

MPlayer <= 1.0_rc4

Fixed version:

FFmpeg >= 0.7.3, >= 0.8.2

Libav, N/A

MPlayer, N/A

Credit: vulnerability report received from Emmanouel Kellinis.


2011-07-14: vulnerability report received
2011-07-15: contacted ffmpeg maintainers
2011-07-15: ffmpeg maintainer confirms the issue, preliminary patch is
2011-07-21: patch approved by reporter
2011-07-23: contacted affected vendors
2011-08-10: advisory release


  Daniele Bianco      Open Source Computer Security Incident Response Team

  GPG Key 0x9544A497
  GPG Key fingerprint = 88A7 43F4 F28F 1B9D 6F2D  4AC5 AE75 822E 9544 A497

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.