Articles / Ubuntu: New FFmpeg packages...

Ubuntu: New FFmpeg packages fix security vulnerabilities

It was discovered that FFmpeg incorrectly handled certain malformed ogg files. If a user were tricked into opening a crafted ogg file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. It was discovered that FFmpeg incorrectly handled certain malformed AMV files. If a user were tricked into opening a crafted AMV file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. It was discovered that FFmpeg incorrectly handled certain malformed APE files. If a user were tricked into opening a crafted APE file, an attacker could cause a denial of service via application crash.

Emmanouel Kellinis discovered that FFmpeg incorrectly handled certain malformed CAVS files. If a user were tricked into opening a crafted CAVS file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. Updated packages are available from security.ubuntu.com.

==========================================================================
Ubuntu Security Notice USN-1209-1
September 19, 2011

ffmpeg vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 10.10
- Ubuntu 10.04 LTS

Summary:

FFmpeg could be made to run programs as your login if it opened a specially
crafted file.

Software Description:
- ffmpeg: multimedia player, server and encoder

Details:

It was discovered that FFmpeg incorrectly handled certain malformed ogg
files. If a user were tricked into opening a crafted ogg file, an attacker
could cause a denial of service via application crash, or possibly execute
arbitrary code with the privileges of the user invoking the program. This
issue only affected Ubuntu 10.10. (CVE-2011-1196)

It was discovered that FFmpeg incorrectly handled certain malformed AMV
files. If a user were tricked into opening a crafted AMV file, an attacker
could cause a denial of service via application crash, or possibly execute
arbitrary code with the privileges of the user invoking the program. This
issue only affected Ubuntu 10.10. (CVE-2011-1931)

It was discovered that FFmpeg incorrectly handled certain malformed APE
files. If a user were tricked into opening a crafted APE file, an attacker
could cause a denial of service via application crash. (CVE-2011-2161)

Emmanouel Kellinis discovered that FFmpeg incorrectly handled certain
malformed CAVS files. If a user were tricked into opening a crafted CAVS
file, an attacker could cause a denial of service via application crash, or
possibly execute arbitrary code with the privileges of the user invoking
the program. (CVE-2011-3362)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 10.10:
 libavcodec52                    4:0.6-2ubuntu6.2
 libavformat52                   4:0.6-2ubuntu6.2

Ubuntu 10.04 LTS:
 libavcodec52                    4:0.5.1-1ubuntu1.2
 libavformat52                   4:0.5.1-1ubuntu1.2

In general, a standard system update will make all the necessary changes.

References:
 http://www.ubuntu.com/usn/usn-1209-1
 CVE-2011-1196, CVE-2011-1931, CVE-2011-2161, CVE-2011-3362

Package Information:
 https://launchpad.net/ubuntu/+source/ffmpeg/4:0.6-2ubuntu6.2
 https://launchpad.net/ubuntu/+source/ffmpeg/4:0.5.1-1ubuntu1.2
Screenshot

Project Spotlight

General Configuration Form Manager

A minimalist Web server for configuration forms.

Screenshot

Project Spotlight

Unflattener

A tool that makes normal maps for 2D art.