CVE-2011-3952

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 0.10 Libav versions 0.5.x through 0.5.8 Libav versions 0.6.x through 0.6.5 Libav versions 0.7.x through 0.7.5 Libav versions 0.8.x through 0.8.0

Description The issue allows remote attackers to cause a denial of service, potentially leading to application crashes, and possibly execute arbitrary code. This is achieved through a large palette size in a KMVC encoded file, exploiting the decode init function in kmvc.c in libavcodec.

Recommendations For FFmpeg versions prior to 0.10, update to version 0.10 or later. For Libav versions 0.5.x through 0.5.8, update to version 0.5.9 or later. For Libav versions 0.6.x through 0.6.5, update to version 0.6.6 or later. For Libav versions 0.7.x through 0.7.5, update to version 0.7.6 or later. For Libav versions 0.8.x through 0.8.0, update to version 0.8.1 or later.