--===============5476503000083576558==
Content-Type: multipart/signed; micalg="pgp-sha512";
protocol="application/pgp-signature";
boundary="=-77DdSHmF2GoiHZrnq0Fh"
--=-77DdSHmF2GoiHZrnq0Fh
Content-Type: text/plain; charset="UTF-8
Content-Transfer-Encoding: quoted-printable
==========================================================================
Ubuntu Security Notice USN-1320-1
January 05, 2012
ffmpeg vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 10.10
- Ubuntu 10.04 LTS
Summary:
FFmpeg could be made to crash or run programs as your login if it
opened a specially crafted file.
Software Description:
- ffmpeg: multimedia player, server and encoder
Details:
Steve Manzuik discovered that FFmpeg incorrectly handled certain malformed
Matroska files. If a user were tricked into opening a crafted Matroska
file, an attacker could cause a denial of service via application crash, or
possibly execute arbitrary code with the privileges of the user invoking
the program. (CVE-2011-3504)
Phillip Langlois discovered that FFmpeg incorrectly handled certain
malformed QDM2 streams. If a user were tricked into opening a crafted QDM2
stream file, an attacker could cause a denial of service via application
crash, or possibly execute arbitrary code with the privileges of the user
invoking the program. (CVE-2011-4351)
Phillip Langlois discovered that FFmpeg incorrectly handled certain
malformed VP3 streams. If a user were tricked into opening a crafted file,
an attacker could cause a denial of service via application crash, or
possibly execute arbitrary code with the privileges of the user invoking
the program. This issue only affected Ubuntu 10.10. (CVE-2011-4352)
Phillip Langlois discovered that FFmpeg incorrectly handled certain
malformed VP5 and VP6 streams. If a user were tricked into opening a
crafted file, an attacker could cause a denial of service via application
crash, or possibly execute arbitrary code with the privileges of the user
invoking the program. (CVE-2011-4353)
It was discovered that FFmpeg incorrectly handled certain malformed VMD
files. If a user were tricked into opening a crafted VMD file, an attacker
could cause a denial of service via application crash, or possibly execute
arbitrary code with the privileges of the user invoking the program.
(CVE-2011-4364)
Phillip Langlois discovered that FFmpeg incorrectly handled certain
malformed SVQ1 streams. If a user were tricked into opening a crafted SVQ1
stream file, an attacker could cause a denial of service via application
crash, or possibly execute arbitrary code with the privileges of the user
invoking the program. (CVE-2011-4579)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 10.10:
libavcodec52 4:0.6-2ubuntu6.3
libavformat52 4:0.6-2ubuntu6.3
Ubuntu 10.04 LTS:
libavcodec52 4:0.5.1-1ubuntu1.3
libavformat52 4:0.5.1-1ubuntu1.3
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1320-1
CVE-2011-3504, CVE-2011-4351, CVE-2011-4352, CVE-2011-4353,
CVE-2011-4364, CVE-2011-4579
Package Information:
https://launchpad.net/ubuntu/+source/ffmpeg/4:0.6-2ubuntu6.3
https://launchpad.net/ubuntu/+source/ffmpeg/4:0.5.1-1ubuntu1.3
--×7DdSHmF2GoiHZrnq0Fh
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part
Content-Transfer-Encoding: 7bit
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iQIcBAABCgAGBQJPBcBoAAoJEGVp2FWnRL6T+NkQAJp9+K6Cq4PHGPsvdyp0L2lR
EB7WtvE7+5gI4/Z0cLFIwhIIHi7bn9BWepL0n2yvytwCf0H/ul8S910VwbSwKEls
cs5CydQAc1yAiAhttY90mTZwmuwbH16mK+fcybLjUnhfPMKC8gAcCpsNDFBFc1OX
rcjmRWjA98VslFdZCJ5PTFsQ5CRTvJJMTHafN+hIOBU49ipuPK3MnxWzLlUOmvIA
OD1FEmpoRdBndo7btki8yPwJmzYejGvT3sXEbcX7CWJXNt96mh/3tQWxg7MY6Kp0
iNd2IjIlyasHEIuAsfXXWbUmb6stK17V3MaHxF8zd17S5sqokzzXuAzETt75WUcD
mHs1Bke0XDEfxyRhO9qgQ+tG0ns9kR6SveqLC8RL/Mcdp4b1roNKUCwjUCAe6kHP
cLnHpWS/0Y2m+gAlqfg/vp4qxLYkkVTBQ3OtrRTAGrLborruEwI6avXhG8gTmuDX
YMAmrfdQjeKKQ985ho6IrfrkgJLCoOquoHzEUpCGrBvTQK1lWJi6qcC3iM4Iqi2m
0kKq2Dn33cBJ6RG7TzbbCdm03X24J+l09eU6OA/uGhOnny0Z7SUh9V4UhMzNLtyb
wlHdHLQxKUlMq/7Ng7AHveBRIfK+kCPf3QhDL7WO7LPiwvbru3PhRiOJ2YXizbaY
hxN/9UbLcwNHt26VF+dC
=iY2s
-----END PGP SIGNATURE-----
--=-77DdSHmF2GoiHZrnq0Fh--
--===============5476503000083576558==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
--===============5476503000083576558==--
|
