Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 524
Alerts This Week
Warning Icon 1 524

Ubuntu 11.04 USN-1209-2 Moderate: Libav Denial Of Service Risks

ubuntu
Calendar Grey September 19, 2011
Scroller Ubuntu
Shortcomings in Libav lead to potential unauthorized code execution and system failures on Ubuntu 11.04. Prompt updates are necessary to address these vulnerabilities.
Libav could be made to run programs as your login if it opened a specially crafted file.

Summary

Libav could be made to run programs as your login if it opened a specially

crafted file.

Software Description:

- libav: Multimedia player, server, encoder and transcoder

Details:

It was discovered that Libav incorrectly handled certain malformed ogg

files. If a user were tricked into opening a crafted ogg file, an attacker

could cause a denial of service via application crash, or possibly execute

arbitrary code with the privileges of the user invoking the program.

(CVE-2011-1196)

It was discovered that Libav incorrectly handled certain malformed AMV

files. If a user were tricked into opening a crafted AMV file, an attacker

could cause a denial of service via application crash, or possibly execute

arbitrary code with the privileges of the user invoking the program.

(CVE-2011-1931)

Emmanouel Kellinis discovered that Libav incorrectly handled certain

malformed CAVS files. If a user were tricked into opening a crafted CAVS

file, an attacker could cause a den...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory denial of service security issue update Ubuntu application crash libav

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.04:
  libavcodec52                    4:0.6.2-1ubuntu1.1
  libavformat52                   4:0.6.2-1ubuntu1.1

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-1209-2

CVE-2011-1196, CVE-2011-1931, CVE-2011-3362

September 19, 2011

Topics%20covered

Topics Covered

security advisory denial of service security issue update Ubuntu application crash libav

Package Information

https://launchpad.net/ubuntu/+source/libav/4:0.6.2-1ubuntu1.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.