CVE-2011-0480

Multiple buffer overflows in vorbis_dec.c in the Vorbis decoder in FFmpeg, as used in Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344, allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a crafted WebM file, related to buffers for (1) the channel floor and (2) the channel residue.
Classic Buffer Overflow
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.3 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:C/I:C/A:C
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 81%
VendorProductVersion
googlechrome_os
𝑥
< 8.0.552.344
googlechrome
𝑥
< 8.0.552.237
debiandebian_linux
6.0
canonicalubuntu_linux
8.04
canonicalubuntu_linux
9.10
canonicalubuntu_linux
10.04
canonicalubuntu_linux
10.10
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
ffmpeg
bullseye
7:4.3.7-0+deb11u1
fixed
squeeze
not-affected
bullseye (security)
7:4.3.8-0+deb11u1
fixed
bookworm
7:5.1.6-0+deb12u1
fixed
bookworm (security)
7:5.1.6-0+deb12u1
fixed
sid
7:7.1-3
fixed
trixie
7:7.1-3
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
chromium-browser
maverick
Fixed 8.0.552.237~r70801-0ubuntu0.10.10.1
released
lucid
Fixed 8.0.552.237~r70801-0ubuntu0.10.04.1
released
karmic
dne
hardy
dne
dapper
dne
ffmpeg
maverick
Fixed 4:0.6-2ubuntu6.1
released
lucid
Fixed 4:0.5.1-1ubuntu1.1
released
karmic
Fixed 4:0.5+svn20090706-2ubuntu2.3
released
hardy
Fixed 3:0.cvs20070307-5ubuntu7.6
released
dapper
ignored
libav
maverick
dne
lucid
dne
karmic
dne
hardy
dne
dapper
dne
References