National Cyber Awareness System

Vulnerability Summary for CVE-2011-1931

Overview

sp5xdec.c in the Sunplus SP5X JPEG decoder in libavcodec in FFmpeg before 0.6.3 and libav through 0.6.2, as used in VideoLAN VLC media player 1.1.9 and earlier and other products, performs a write operation outside the bounds of an unspecified array, which allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a malformed AMV file.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: http://git.videolan.org/?p=ffmpeg.git;a=commit;h=89f903b3d5ec38c9c5d90fba7e626fa0eda61a32

Type: Patch Information

Hyperlink:http://git.videolan.org/?p=ffmpeg.git;a=commit;h=89f903b3d5ec38c9c5d90fba7e626fa0eda61a32

External Source: CONFIRM

Name: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=624339

Type: Patch Information

Hyperlink:http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=624339

External Source: BID

Name: 47602

Hyperlink:http://www.securityfocus.com/bid/47602

External Source: BUGTRAQ

Name: 20110427 NGS00068 Patch Notification: LibAVCodec AMV Out of Array Write

Hyperlink:http://www.securityfocus.com/archive/1/517706

External Source: SREASON

Name: 8299

Hyperlink:http://securityreason.com/securityalert/8299