Vulnerability Details : CVE-2011-4353
The (1) av_image_fill_pointers, (2) vp5_parse_coeff, and (3) vp6_parse_coeff functions in FFmpeg 0.5.x before 0.5.7, 0.6.x before 0.6.4, 0.7.x before 0.7.9, and 0.8.x before 0.8.8; and in Libav 0.5.x before 0.5.6, 0.6.x before 0.6.4, and 0.7.x before 0.7.3 allow remote attackers to cause a denial of service (out-of-bounds read) via a crafted VP5 or VP6 stream.
Vulnerability category: OverflowDenial of service
Exploit prediction scoring system (EPSS) score for CVE-2011-4353
Probability of exploitation activity in the next 30 days: 0.42%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 74 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2011-4353
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:N/A:P |
8.6
|
2.9
|
NIST |
CWE ids for CVE-2011-4353
-
The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.Assigned by: nvd@nist.gov (Primary)
References for CVE-2011-4353
- http://libav.org/releases/libav-0.6.4.changelog
-
http://ubuntu.com/usn/usn-1320-1
USN-1320-1: FFmpeg vulnerabilities | Ubuntu security notices
- http://libav.org/releases/libav-0.5.6.changelog
-
http://www.mandriva.com/security/advisories?name=MDVSA-2012:076
mandriva.com
-
http://www.mandriva.com/security/advisories?name=MDVSA-2012:074
mandriva.com
-
http://ubuntu.com/usn/usn-1333-1
USN-1333-1: Libav vulnerabilities | Ubuntu security notices
-
http://ffmpeg.org/
FFmpeg
- http://libav.org/releases/libav-0.7.3.changelog
- http://libav.org/
-
http://www.mandriva.com/security/advisories?name=MDVSA-2012:075
mandriva.com
Products affected by CVE-2011-4353
- cpe:2.3:a:ffmpeg:ffmpeg:0.5:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:0.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:0.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:0.6:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:0.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:0.5.4:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:0.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:0.7.1:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:0.6.2:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:0.8.1:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:0.8.0:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:0.7.6:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:0.7.2:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:0.7.8:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:0.7.7:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:0.8.7:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:0.8.6:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:0.8.5:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:0.7.3:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:0.7:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:0.8.2:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:0.5.5:*:*:*:*:*:*:*
- cpe:2.3:a:libav:libav:0.5.4:*:*:*:*:*:*:*
- cpe:2.3:a:libav:libav:0.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:libav:libav:0.6:*:*:*:*:*:*:*
- cpe:2.3:a:libav:libav:0.5:*:*:*:*:*:*:*
- cpe:2.3:a:libav:libav:0.6.2:*:*:*:*:*:*:*
- cpe:2.3:a:libav:libav:0.5.5:*:*:*:*:*:*:*
- cpe:2.3:a:libav:libav:0.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:libav:libav:0.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:libav:libav:0.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:libav:libav:0.6.5:*:*:*:*:*:*:*
- cpe:2.3:a:libav:libav:0.6.4:*:*:*:*:*:*:*
- cpe:2.3:a:libav:libav:0.6.3:*:*:*:*:*:*:*
- cpe:2.3:a:libav:libav:0.7.2:*:*:*:*:*:*:*
- cpe:2.3:a:libav:libav:0.7.1:*:*:*:*:*:*:*
- cpe:2.3:a:libav:libav:0.7:*:*:*:*:*:*:*