Bug#654534: libav: multiple security issues

[Reinhard Tartler]

clone 654534 -1 -2 -3
retitle -1 CVE-2011-3892: Double free vulnerability in the Theora decoder
retitle -2 CVE-2011-3893: DoS in MKV demuxer
retitle -3 CVE-2011-3895: heap-based buffer overflow in vorbis decoder
forwarded -1 http://bugzilla.libav.org/show_bug.cgi?id=189
forwarded -2 http://bugzilla.libav.org/show_bug.cgi?id=190
forwarded -3 http://bugzilla.libav.org/show_bug.cgi?id=191
block 654534 by -1 -2 -3
stop

On Mi, Jan 04, 2012 at 01:35:33 (CET), Michael Gilbert wrote:

[...]

> CVE-2011-3892[0]:
> | Double free vulnerability in the Theora decoder in Google Chrome
> | before 15.0.874.120 allows remote attackers to cause a denial of
> | service or possibly have unspecified other impact via a crafted
> | stream.
>
> CVE-2011-3893[1]:
> | Google Chrome before 15.0.874.120 does not properly implement the MKV
> | and Vorbis media handlers, which allows remote attackers to cause a
> | denial of service (out-of-bounds read) via unspecified vectors.
>
> CVE-2011-3895[2]:
> | Heap-based buffer overflow in the Vorbis decoder in Google Chrome
> | before 15.0.874.120 allows remote attackers to cause a denial of
> | service or possibly have unspecified other impact via a crafted
> | stream.

Forwarded all upstream. Please file seperate bugs so that we can track
their status individually.


-- 
Gruesse/greetings,
Reinhard Tartler, KeyID 945348A4