#VU43212 Input validation error in FFmpeg and Libav - CVE-2011-3937

Vulnerability identifier: #VU43212

Vulnerability risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2011-3937

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
FFmpeg
Universal components / Libraries / Libraries used by multiple products
Libav
Client/Desktop applications / Multimedia software

Vendor: ffmpeg.sourceforge.net
Libav

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The H.263 codec (libavcodec/h263dec.c) in FFmpeg 0.7.x before 0.7.12, 0.8.x before 0.8.11, and unspecified versions before 0.10, and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.5, and 0.8.x before 0.8.1 has unspecified impact and attack vectors related to "width/height changing with frame threads."

Mitigation
Install update from vendor's website.

Vulnerable software versions

FFmpeg: 0.3 - 0.9

Libav: 0.3 - 0.9

---

External links
https://ffmpeg.org/security.html
https://git.libav.org/?p=libav.git;a=commit;h=71db86d53b5c6872cea31bf714a1a38ec78feaba
https://git.videolan.org/?p=ffmpeg.git;a=commit;h=71db86d53b5c6872cea31bf714a1a38ec78feaba
https://libav.org/news.html
https://www.mandriva.com/security/advisories?name=MDVSA-2013:079

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.