9.3
CVSSv2

CVE-2011-3504

Published: 29/09/2011 Updated: 30/10/2018
CVSS v2 Base Score: 9.3 | Impact Score: 10 | Exploitability Score: 8.6
VMScore: 828
Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Vulnerability Summary

The Matroska format decoder in FFmpeg prior to 0.8.3 does not properly allocate memory, which allows remote malicious users to execute arbitrary code via a crafted file.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

ffmpeg ffmpeg 0.5.2

ffmpeg ffmpeg 0.5.1

ffmpeg ffmpeg 0.4.5

ffmpeg ffmpeg 0.4.4

ffmpeg ffmpeg 0.3

ffmpeg ffmpeg 0.5.4

ffmpeg ffmpeg 0.5.3

ffmpeg ffmpeg 0.4.7

ffmpeg ffmpeg 0.4.6

ffmpeg ffmpeg 0.3.3

ffmpeg ffmpeg 0.3.2

ffmpeg ffmpeg 0.3.1

ffmpeg ffmpeg

ffmpeg ffmpeg 0.6.2

ffmpeg ffmpeg 0.5

ffmpeg ffmpeg 0.4.9

ffmpeg ffmpeg 0.4.3

ffmpeg ffmpeg 0.4.2

ffmpeg ffmpeg 0.6.1

ffmpeg ffmpeg 0.6

ffmpeg ffmpeg 0.4.8

ffmpeg ffmpeg 0.4.0

ffmpeg ffmpeg 0.3.4

Vendor Advisories

Debian Bug report logs - #641478 libavcodec insufficient boundary check in CAVS decoding Package: libav; Maintainer for libav is Debian Multimedia Maintainers <pkg-multimedia-maintainers@listsaliothdebianorg>; Reported by: Moritz Muehlenhoff <muehlenhoff@univentionde> Date: Tue, 13 Sep 2011 16:45:02 UTC Severity: ...
Debian Bug report logs - #643859 CVE-2011-3504 Package: libav; Maintainer for libav is Debian Multimedia Maintainers <pkg-multimedia-maintainers@listsaliothdebianorg>; Reported by: Moritz Muehlenhoff <muehlenhoff@univentionde> Date: Fri, 30 Sep 2011 14:03:01 UTC Severity: important Tags: security Fixed in versio ...
Libav could be made to crash or run programs as your login if it opened a specially crafted file ...
FFmpeg could be made to crash or run programs as your login if it opened a specially crafted file ...
Multiple vulnerabilities were found in FFmpeg, a multimedia player, server and encoder: CVE-2011-3362 An integer signedness error in decode_residual_block function of the Chinese AVS video (CAVS) decoder in libavcodec can lead to denial of service (memory corruption and application crash) or possible code execution via a crafted CA ...