Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 524
Alerts This Week
Warning Icon 1 524

Ubuntu 10.10: USN-1209-1 Important Security Flaws in FFmpeg Detected

ubuntu
Calendar Grey September 19, 2011
Scroller Ubuntu
Security flaws in FFmpeg versions found in Ubuntu 10.10 and 10.04 LTS may lead to unauthorized code execution and potential denial of service incidents.
FFmpeg could be made to run programs as your login if it opened a specially crafted file.

Summary

FFmpeg could be made to run programs as your login if it opened a specially

crafted file.

Software Description:

- ffmpeg: multimedia player, server and encoder

Details:

It was discovered that FFmpeg incorrectly handled certain malformed ogg

files. If a user were tricked into opening a crafted ogg file, an attacker

could cause a denial of service via application crash, or possibly execute

arbitrary code with the privileges of the user invoking the program. This

issue only affected Ubuntu 10.10. (CVE-2011-1196)

It was discovered that FFmpeg incorrectly handled certain malformed AMV

files. If a user were tricked into opening a crafted AMV file, an attacker

could cause a denial of service via application crash, or possibly execute

arbitrary code with the privileges of the user invoking the program. This

issue only affected Ubuntu 10.10. (CVE-2011-1931)

It was discovered that FFmpeg incorrectly handled certain malformed APE

files. If a user were tricked into o...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory denial of service critical software update Ubuntu vulnerability ffmpeg

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 10.10:
  libavcodec52                    4:0.6-2ubuntu6.2
  libavformat52                   4:0.6-2ubuntu6.2

Ubuntu 10.04 LTS:
  libavcodec52                    4:0.5.1-1ubuntu1.2
  libavformat52                   4:0.5.1-1ubuntu1.2

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-1209-1

CVE-2011-1196, CVE-2011-1931, CVE-2011-2161, CVE-2011-3362

Severity
important
Lowest
Low
Medium
High
Critical

September 19, 2011

Topics%20covered

Topics Covered

security advisory denial of service critical software update Ubuntu vulnerability ffmpeg

Package Information

https://launchpad.net/ubuntu/+source/ffmpeg/4:0.6-2ubuntu6.2
https://launchpad.net/ubuntu/+source/ffmpeg/4:0.5.1-1ubuntu1.2

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.