FFmpeg contains a flaw in the Vorbis decoder within the 'vorbis_parse_setup_hdr_floors' function [vorbis_dec.c]. The issue is triggered as user-supplied input is not properly sanitized when processing the channel floor value. With a specially crafted WebM file, a context-dependent attacker can corrupt memory to cause a denial of service or potentially execute arbitrary code.

Upgrade to version 0.6.90-rc0 (FFmpeg), 8.0.552.237 (Chrome), 8.0.552.344 (Chrome OS) or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• OVAL ID: 14380
• CVE ID: 2011-0480 (see also: NVD)
• Secunia Advisory ID: 42850 42951 43971 45964
• Bugtraq ID: 45788
• ISS X-Force ID: 64671
• Other Advisory URL: http://article.gmane.org/gmane.comp.video.ffmpeg.devel/122703
  http://www.mandriva.com/security/advisories?name=MDVSA-2011:061
  http://www.srware.net/forum/viewtopic.php?f=18&t=2054
  http://www.ubuntu.com/usn/usn-1104-1/
• Vendor Specific News/Changelog Entry: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=610550
  http://code.google.com/p/chromium/issues/detail?id=68115
  http://codereview.chromium.org/5964011
  http://codereview.chromium.org/6069005
  http://ffmpeg.mplayerhq.hu/
  http://git.ffmpeg.org/?p=ffmpeg.git;a=commit;h=13184036a6b1b1d4b61c91118c0896e9ad4634c3
  http://googlechromereleases.blogspot.com/2011/01/chrome-stable-release.html
  http://roundup.ffmpeg.org/issue2548 [ Link is 404 ]
  http://roundup.ffmpeg.org/issue2550 [ Link is 404 ]
  http://src.chromium.org/viewvc/chrome?view=rev&revision=70200
  http://www.srware.net/forum/viewtopic.php?f=18&t=2054
• Vendor Specific Advisory URL: http://www.debian.org/security/2011/dsa-2306
  http://www.ubuntu.com/usn/usn-1104-1

• David Warren - CERT