CVE-2011-3504

Published: Sep 29, 2011Modified: Apr 29, 2026

9.3

Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 8.6 / Impact: 10.0

Source: NVD

Description

The Matroska format decoder in FFmpeg before 0.8.3 does not properly allocate memory, which allows remote attackers to execute arbitrary code via a crafted file.

Affected (24)

Products: Ffmpeg: Ffmpeg

1 product

Configuration A

24 vulnerable

Vulnerable Software	Affected Versions
Ffmpeg Ffmpeg	Up to 0.8.0
Ffmpeg Ffmpeg	Version 0.3.1
Ffmpeg Ffmpeg	Version 0.3.2
Ffmpeg Ffmpeg	Version 0.3.3
Ffmpeg Ffmpeg	Version 0.3.4
Ffmpeg Ffmpeg	Version 0.3
Ffmpeg Ffmpeg	Version 0.4.0
Ffmpeg Ffmpeg	Version 0.4.2
Ffmpeg Ffmpeg	Version 0.4.3
Ffmpeg Ffmpeg	Version 0.4.4
Ffmpeg Ffmpeg	Version 0.4.5
Ffmpeg Ffmpeg	Version 0.4.6
Ffmpeg Ffmpeg	Version 0.4.7
Ffmpeg Ffmpeg	Version 0.4.8
Ffmpeg Ffmpeg	Version 0.4.9
Ffmpeg Ffmpeg	Version 0.4.9 pre1
Ffmpeg Ffmpeg	Version 0.5.1
Ffmpeg Ffmpeg	Version 0.5.2
Ffmpeg Ffmpeg	Version 0.5.3
Ffmpeg Ffmpeg	Version 0.5.4
Ffmpeg Ffmpeg	Version 0.5
Ffmpeg Ffmpeg	Version 0.6.1
Ffmpeg Ffmpeg	Version 0.6.2
Ffmpeg Ffmpeg	Version 0.6

Related CWEs

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (20)

http://secunia.com/advisories/45532

Source: cve@mitre.org

http://technet.microsoft.com/en-us/security/msvr/msvr11-011

Source: cve@mitre.org

http://ubuntu.com/usn/usn-1320-1

Source: cve@mitre.org

http://ubuntu.com/usn/usn-1333-1

Source: cve@mitre.org

http://www.ffmpeg.org/releases/ffmpeg-0.7.5.changelog

Source: cve@mitre.org

http://www.ffmpeg.org/releases/ffmpeg-0.8.4.changelog

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDVSA-2012:074

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDVSA-2012:075

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDVSA-2012:076

Source: cve@mitre.org

http://www.osvdb.org/75621

Source: cve@mitre.org

http://secunia.com/advisories/45532

Source: af854a3a-2127-422b-91ae-364da2661108

http://technet.microsoft.com/en-us/security/msvr/msvr11-011

Source: af854a3a-2127-422b-91ae-364da2661108

http://ubuntu.com/usn/usn-1320-1

Source: af854a3a-2127-422b-91ae-364da2661108

http://ubuntu.com/usn/usn-1333-1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ffmpeg.org/releases/ffmpeg-0.7.5.changelog

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ffmpeg.org/releases/ffmpeg-0.8.4.changelog

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mandriva.com/security/advisories?name=MDVSA-2012:074

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mandriva.com/security/advisories?name=MDVSA-2012:075

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mandriva.com/security/advisories?name=MDVSA-2012:076

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.osvdb.org/75621

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.