CVE-2011-3362

Integer signedness error in the decode_residual_block function in cavsdec.c in libavcodec in FFmpeg before 0.7.3 and 0.8.x before 0.8.2, and libav through 0.7.1, allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted Chinese AVS video (aka CAVS) file.

Affected Software

Name	Vendor	Start Version	End Version
Ffmpeg	Ffmpeg	*	0.7.2 (including)
Ffmpeg	Ffmpeg	0.3 (including)	0.3 (including)
Ffmpeg	Ffmpeg	0.3.1 (including)	0.3.1 (including)
Ffmpeg	Ffmpeg	0.3.2 (including)	0.3.2 (including)
Ffmpeg	Ffmpeg	0.3.3 (including)	0.3.3 (including)
Ffmpeg	Ffmpeg	0.3.4 (including)	0.3.4 (including)
Ffmpeg	Ffmpeg	0.4.0 (including)	0.4.0 (including)
Ffmpeg	Ffmpeg	0.4.2 (including)	0.4.2 (including)
Ffmpeg	Ffmpeg	0.4.3 (including)	0.4.3 (including)
Ffmpeg	Ffmpeg	0.4.4 (including)	0.4.4 (including)
Ffmpeg	Ffmpeg	0.4.5 (including)	0.4.5 (including)
Ffmpeg	Ffmpeg	0.4.6 (including)	0.4.6 (including)
Ffmpeg	Ffmpeg	0.4.7 (including)	0.4.7 (including)
Ffmpeg	Ffmpeg	0.4.8 (including)	0.4.8 (including)
Ffmpeg	Ffmpeg	0.4.9-pre1 (including)	0.4.9-pre1 (including)
Ffmpeg	Ffmpeg	0.5 (including)	0.5 (including)
Ffmpeg	Ffmpeg	0.5.1 (including)	0.5.1 (including)
Ffmpeg	Ffmpeg	0.5.2 (including)	0.5.2 (including)
Ffmpeg	Ffmpeg	0.5.3 (including)	0.5.3 (including)
Ffmpeg	Ffmpeg	0.5.4 (including)	0.5.4 (including)
Ffmpeg	Ffmpeg	0.6 (including)	0.6 (including)
Ffmpeg	Ffmpeg	0.6.1 (including)	0.6.1 (including)
Ffmpeg	Ffmpeg	0.6.2 (including)	0.6.2 (including)
Ffmpeg	Ffmpeg	0.7.1 (including)	0.7.1 (including)
Ffmpeg	Ubuntu	hardy	*
Ffmpeg	Ubuntu	lucid	*
Ffmpeg	Ubuntu	maverick	*
Ffmpeg-extra	Ubuntu	lucid	*
Ffmpeg-extra	Ubuntu	maverick	*
Libav	Ubuntu	natty	*
Libav-extra	Ubuntu	natty	*
Libav-extra	Ubuntu	oneiric	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2011-3362
CWE	https://cwe.mitre.org/data/definitions/189.html

Affected Software

References