CVE-2011-3940

nsvdec.c in libavcodec in FFmpeg 0.7.x before 0.7.12 and 0.8.x before 0.8.11, and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.5, and 0.8.x before 0.8.1, allows remote attackers to cause a denial of service (out-of-bounds read and write) via a crafted NSV file that triggers "use of uninitialized streams."

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://ffmpeg.org/
http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=5c011706bc752d34bc6ada31d7df2ca0c9af7c6b
http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=8fd8a48263ff1437f9d02d7e78dc63efb9b5ed3a
http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=c898431ca5ef2a997fe9388b650f658fb60783e5
http://libav.org/
http://secunia.com/advisories/49089
http://www.debian.org/security/2012/dsa-2471
http://www.ubuntu.com/usn/USN-1479-1
http://ffmpeg.org/
http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=5c011706bc752d34bc6ada31d7df2ca0c9af7c6b
http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=8fd8a48263ff1437f9d02d7e78dc63efb9b5ed3a
http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=c898431ca5ef2a997fe9388b650f658fb60783e5
http://libav.org/
http://secunia.com/advisories/49089
http://www.debian.org/security/2012/dsa-2471
http://www.ubuntu.com/usn/USN-1479-1

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ffmpeg:ffmpeg:0.7.1:::::::*
	cpe:2.3:a:ffmpeg:ffmpeg:0.7.2:::::::*
	cpe:2.3:a:ffmpeg:ffmpeg:0.7.6:::::::*
	cpe:2.3:a:ffmpeg:ffmpeg:0.7.7:::::::*
	cpe:2.3:a:ffmpeg:ffmpeg:0.7.8:::::::*
	cpe:2.3:a:ffmpeg:ffmpeg:0.7.9:::::::*
	cpe:2.3:a:ffmpeg:ffmpeg:0.7.11:::::::*

Configuration 2 (hide)

OR	cpe:2.3:a:ffmpeg:ffmpeg:0.8.5:::::::*
	cpe:2.3:a:ffmpeg:ffmpeg:0.8.6:::::::*
	cpe:2.3:a:ffmpeg:ffmpeg:0.8.7:::::::*
	cpe:2.3:a:ffmpeg:ffmpeg:0.8.8:::::::*
	cpe:2.3:a:ffmpeg:ffmpeg:0.8.10:::::::*

Configuration 3 (hide)

OR	cpe:2.3:a:libav:libav:0.5:::::::*
	cpe:2.3:a:libav:libav:0.5.1:::::::*
	cpe:2.3:a:libav:libav:0.5.2:::::::*
	cpe:2.3:a:libav:libav:0.5.3:::::::*
	cpe:2.3:a:libav:libav:0.5.4:::::::*
	cpe:2.3:a:libav:libav:0.5.5:::::::*
	cpe:2.3:a:libav:libav:0.5.6:::::::*
	cpe:2.3:a:libav:libav:0.5.7:::::::*

Configuration 4 (hide)

OR	cpe:2.3:a:libav:libav:0.6:::::::*
	cpe:2.3:a:libav:libav:0.6.1:::::::*
	cpe:2.3:a:libav:libav:0.6.2:::::::*
	cpe:2.3:a:libav:libav:0.6.3:::::::*
	cpe:2.3:a:libav:libav:0.6.4:::::::*
	cpe:2.3:a:libav:libav:0.6.5:::::::*

Configuration 5 (hide)

OR	cpe:2.3:a:libav:libav:0.7:::::::*
	cpe:2.3:a:libav:libav:0.7.1:::::::*
	cpe:2.3:a:libav:libav:0.7.2:::::::*
	cpe:2.3:a:libav:libav:0.7.3:::::::*
	cpe:2.3:a:libav:libav:0.7.4:::::::*

Configuration 6 (hide)

OR	cpe:2.3:a:libav:libav:0.8:::::::*
	cpe:2.3:a:libav:libav:0.8:beta2::::::

History

21 Nov 2024, 01:31

Type	Values Removed	Values Added
References	~~() http://ffmpeg.org/ -~~	() http://ffmpeg.org/ -
References	~~() http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=5c011706bc752d34bc6ada31d7df2ca0c9af7c6b -~~	() http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=5c011706bc752d34bc6ada31d7df2ca0c9af7c6b -
References	~~() http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=8fd8a48263ff1437f9d02d7e78dc63efb9b5ed3a -~~	() http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=8fd8a48263ff1437f9d02d7e78dc63efb9b5ed3a -
References	~~() http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=c898431ca5ef2a997fe9388b650f658fb60783e5 -~~	() http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=c898431ca5ef2a997fe9388b650f658fb60783e5 -
References	~~() http://libav.org/ -~~	() http://libav.org/ -
References	~~() http://secunia.com/advisories/49089 -~~	() http://secunia.com/advisories/49089 -
References	~~() http://www.debian.org/security/2012/dsa-2471 -~~	() http://www.debian.org/security/2012/dsa-2471 -
References	~~() http://www.ubuntu.com/usn/USN-1479-1 -~~	() http://www.ubuntu.com/usn/USN-1479-1 -

07 Nov 2023, 02:09

Type	Values Removed	Values Added
References	{'url': 'http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=5c011706bc752d34bc6ada31d7df2ca0c9af7c6b', 'name': 'http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=5c011706bc752d34bc6ada31d7df2ca0c9af7c6b', 'tags': ['Exploit', 'Patch'], 'refsource': 'CONFIRM'} {'url': 'http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=8fd8a48263ff1437f9d02d7e78dc63efb9b5ed3a', 'name': 'http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=8fd8a48263ff1437f9d02d7e78dc63efb9b5ed3a', 'tags': ['Exploit', 'Patch'], 'refsource': 'CONFIRM'} {'url': 'http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=c898431ca5ef2a997fe9388b650f658fb60783e5', 'name': 'http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=c898431ca5ef2a997fe9388b650f658fb60783e5', 'tags': ['Exploit', 'Patch'], 'refsource': 'CONFIRM'}	() http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=5c011706bc752d34bc6ada31d7df2ca0c9af7c6b - () http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=8fd8a48263ff1437f9d02d7e78dc63efb9b5ed3a - () http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=c898431ca5ef2a997fe9388b650f658fb60783e5 -
References	~~(CONFIRM) http://ffmpeg.org/ - Vendor Advisory~~	() http://ffmpeg.org/ -
References	~~(CONFIRM) http://libav.org/ - Vendor Advisory~~	() http://libav.org/ -
References	~~(DEBIAN) http://www.debian.org/security/2012/dsa-2471 -~~	() http://www.debian.org/security/2012/dsa-2471 -
References	~~(UBUNTU) http://www.ubuntu.com/usn/USN-1479-1 -~~	() http://www.ubuntu.com/usn/USN-1479-1 -
References	~~(SECUNIA) http://secunia.com/advisories/49089 -~~	() http://secunia.com/advisories/49089 -

Information

Published : 2012-08-20 18:55

Updated : 2024-11-21 01:31

NVD link : CVE-2011-3940

Mitre link : CVE-2011-3940

CVE.ORG link : CVE-2011-3940

JSON object : View

Products Affected

libav

libav

ffmpeg

ffmpeg

CWE

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

6.8 /10