Executive Summary

Summary
Title Libav: Multiple vulnerabilities
Informations
Name GLSA-201210-06 First vendor Publication 2012-10-20
Vendor Gentoo Last vendor Modification 2012-10-20
Severity (Vendor) Normal Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score 10 Attack Range Network
Cvss Impact Score 10 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Synopsis

Multiple vulnerabilities have been found in Libav, allowing attackers to execute arbitrary code or cause Denial of Service.

Background

Libav is a complete solution to record, convert and stream audio and video.

Description

Multiple vulnerabilities have been discovered in Libav. Please review the CVE identifiers referenced below for details.

Impact

A remote attacker could entice a user to open a specially crafted media file in an application linked against Libav, possibly resulting in execution of arbitrary code with the privileges of the application or a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All Libav users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=media-video/libav-0.8.3"

References

[ 1 ] CVE-2011-3929 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3929
[ 2 ] CVE-2011-3936 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3936
[ 3 ] CVE-2011-3937 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3937
[ 4 ] CVE-2011-3937 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3937
[ 5 ] CVE-2011-3940 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3940
[ 6 ] CVE-2011-3945 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3945
[ 7 ] CVE-2011-3947 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3947
[ 8 ] CVE-2011-3951 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3951
[ 9 ] CVE-2011-3952 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3952
[ 10 ] CVE-2012-0848 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0848
[ 11 ] CVE-2012-0851 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0851
[ 12 ] CVE-2012-0852 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0852
[ 13 ] CVE-2012-0853 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0853
[ 14 ] CVE-2012-0858 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0858
[ 15 ] CVE-2012-0947 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0947

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-201210-06.xml

Original Source

Url : http://security.gentoo.org/glsa/glsa-201210-06.xml

CWE : Common Weakness Enumeration

% Id Name
69 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer
23 % CWE-20 Improper Input Validation
8 % CWE-399 Resource Management Errors

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:17641
 
Oval ID: oval:org.mitre.oval:def:17641
Title: USN-1478-1 -- libav vulnerabilities
Description: Libav could be made to crash or run programs as your login if it opened a specially crafted file.
Family: unix Class: patch
Reference(s): USN-1478-1
CVE-2011-3929
CVE-2011-3936
CVE-2011-3940
CVE-2011-3945
CVE-2011-3947
CVE-2011-3951
CVE-2011-3952
CVE-2011-4031
CVE-2012-0848
CVE-2012-0850
CVE-2012-0851
CVE-2012-0852
CVE-2012-0853
CVE-2012-0858
CVE-2012-0859
CVE-2012-0947
 Version: 5
Platform(s): Ubuntu 12.04
Ubuntu 11.10
Ubuntu 11.04
 Product(s): libav
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:17815
 
Oval ID: oval:org.mitre.oval:def:17815
Title: USN-1479-1 -- ffmpeg vulnerabilities
Description: FFmpeg could be made to crash or run programs as your login if it opened a specially crafted file.
Family: unix Class: patch
Reference(s): USN-1479-1
CVE-2011-3929
CVE-2011-3936
CVE-2011-3940
CVE-2011-3947
CVE-2011-3951
CVE-2011-3952
CVE-2012-0851
CVE-2012-0852
CVE-2012-0853
CVE-2012-0858
CVE-2012-0859
CVE-2012-0947
 Version: 5
Platform(s): Ubuntu 10.04
 Product(s): ffmpeg
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:18368
 
Oval ID: oval:org.mitre.oval:def:18368
Title: DSA-2471-1 ffmpeg - several
Description: Several vulnerabilities have been discovered in FFmpeg, a multimedia player, server and encoder. Multiple input validations in the decoders/ demuxers for Westwood Studios VQA, Apple MJPEG-B, Theora, Matroska, Vorbis, Sony ATRAC3, DV, NSV, files could lead to the execution of arbitrary code.
Family: unix Class: patch
Reference(s): DSA-2471-1
CVE-2011-3892
CVE-2011-3893
CVE-2011-3895
CVE-2011-3929
CVE-2011-3936
CVE-2011-3940
CVE-2011-3947
CVE-2012-0853
CVE-2012-0947
 Version: 5
Platform(s): Debian GNU/Linux 6.0
Debian GNU/kFreeBSD 6.0
 Product(s): ffmpeg
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:20187
 
Oval ID: oval:org.mitre.oval:def:20187
Title: DSA-2494-1 ffmpeg - several
Description: It was discovered that FFmpeg, Debian's version of the Libav media codec suite, contains vulnerabilities in the DPCM codecs (<a href="http://security-tracker.debian.org/tracker/CVE-2011-3951">CVE-2011-3951</a>), H.264 (<a href="http://security-tracker.debian.org/tracker/CVE-2012-0851">CVE-2012-0851</a>), ADPCM (<a href="http://security-tracker.debian.org/tracker/CVE-2012-0852">CVE-2012-0852</a>), and the KMVC decoder (<a href="http://security-tracker.debian.org/tracker/CVE-2011-3952">CVE-2011-3952</a>).
Family: unix Class: patch
Reference(s): DSA-2494-1
CVE-2011-3951
CVE-2011-3952
CVE-2012-0851
CVE-2012-0852
 Version: 5
Platform(s): Debian GNU/Linux 6.0
Debian GNU/kFreeBSD 6.0
 Product(s): ffmpeg
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 64
Application 27

OpenVAS Exploits

Date Description
2013-09-18 Name : Debian Security Advisory DSA 2471-1 (ffmpeg - several vulnerabilities)
File : nvt/deb_2471_1.nasl
2012-10-22 Name : Gentoo Security Advisory GLSA 201210-06 (libav)
File : nvt/glsa_201210_06.nasl
2012-08-10 Name : Debian Security Advisory DSA 2494-1 (ffmpeg)
File : nvt/deb_2494_1.nasl
2012-08-03 Name : Mandriva Update for ffmpeg MDVSA-2012:076 (ffmpeg)
File : nvt/gb_mandriva_MDVSA_2012_076.nasl
2012-06-19 Name : Ubuntu Update for libav USN-1478-1
File : nvt/gb_ubuntu_USN_1478_1.nasl
2012-06-19 Name : Ubuntu Update for ffmpeg USN-1479-1
File : nvt/gb_ubuntu_USN_1479_1.nasl

Nessus® Vulnerability Scanner

Date Description
2013-10-27 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201310-12.nasl - Type : ACT_GATHER_INFO
2013-08-21 Name : The remote FreeBSD host is missing a security-related update.
File : freebsd_pkg_4d087b35099011e3a9f4bcaec565249c.nasl - Type : ACT_GATHER_INFO
2013-04-20 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2013-079.nasl - Type : ACT_GATHER_INFO
2013-02-18 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2624.nasl - Type : ACT_GATHER_INFO
2012-10-22 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201210-06.nasl - Type : ACT_GATHER_INFO
2012-09-06 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2012-076.nasl - Type : ACT_GATHER_INFO
2012-06-29 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2494.nasl - Type : ACT_GATHER_INFO
2012-06-19 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-1478-1.nasl - Type : ACT_GATHER_INFO
2012-06-19 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-1479-1.nasl - Type : ACT_GATHER_INFO
2012-05-15 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2471.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
2
Date Informations
2014-02-17 11:37:38
  • Multiple Updates
2013-01-07 21:21:30
  • Multiple Updates
2013-01-05 13:22:48
  • Multiple Updates