Your message dated Sat, 9 Jun 2012 12:49:02 +0200
with message-id
<CAJ0cceYR0=Oco5dcA0H=Z_OoicUNrCUrDwLESA2ZF4NgYs4u=w...@mail.gmail.com>
and subject line Re: Bug#675767: src:libav: check CVE-2011-4031 (integer
underflow in asfrtp_parse_packet)
has caused the Debian Bug report #675767,
regarding src:libav: check CVE-2011-4031 (integer underflow in
asfrtp_parse_packet)
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
675767: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=675767
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: src:libav
Version: 6:0.8.2-2
Severity: important
Tags: security
Dear multimedia maintainers,
Please determine whether libav is affected by CVE-2011-4031:
| Integer underflow in the asfrtp_parse_packet function in
| libavformat/rtpdec_asf.c in FFmpeg before 0.8.3 allows remote attackers
| to execute arbitrary code via a crafted ASF packet.
Thanks
Helmut
--- End Message ---
--- Begin Message ---
fixed 675767 0.8-1
On Sun, Jun 3, 2012 at 11:11 AM, Helmut Grohne <[email protected]> wrote:
> Package: src:libav
> Version: 6:0.8.2-2
> Severity: important
> Tags: security
>
> Dear multimedia maintainers,
>
> Please determine whether libav is affected by CVE-2011-4031:
>
> | Integer underflow in the asfrtp_parse_packet function in
> | libavformat/rtpdec_asf.c in FFmpeg before 0.8.3 allows remote attackers
> | to execute arbitrary code via a crafted ASF packet.
This has been fixed upstream before in the very first 0.8 release. As
such, I do not believe that this issue has ever existed in debian. I
guess this refers to the following commit in FFmpeg:
commit b15e85d8207bf644e5fc8837b4fad2ae3f33d021
Author: Michael Niedermayer <[email protected]>
Date: Wed Sep 7 14:12:42 2011 +0200
rtpdec_asf: Fix integer underflow that could allow remote code execution
Fixes MSVR-11-0088
Fixes CVE-2011-4031
Credit: Jeong Wook Oh of Microsoft and Microsoft Vulnerability
Research (MSVR)
Signed-off-by: Michael Niedermayer <[email protected]>
Signed-off-by: Martin Storsjö <[email protected]>
(cherry picked from commit 5ea091fb5a12dc0210b8efdf30b573b87e21652b)
Signed-off-by: Reinhard Tartler <[email protected]>
However, 5ea091fb5a12dc0210b8efdf30b573b87e21652b is already in the
0.8 upstream release.
Nevertheless, thanks for caring about security issues in libavcodec!
--
regards,
Reinhard
--- End Message ---
