FFmpeg contains an out-of-bounds read flaw in the 'ff_h264_decode_extradata' function [libavcodec/h264.c] when parsing extra data. With a specially crafted H.264 media file, a context-dependent attacker can crash the process or potentially disclose memory.

It has been reported that this issue has been fixed. Upgrade to version 0.8.5 or higher to address this vulnerability.

Upgrade to Google Chrome version 17.0.963.56 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• CVE ID: 2011-3025 (see also: NVD)
• Secunia Advisory ID: 48016 48059 48866
• Related OSVDB ID: 79283 79284 79285 79286 79287 79288 79289 79290 79291 79292 79294 79295
• Vendor Specific Solution URL: http://git.videolan.org/?p=ffmpeg.git;a=commit;h=101e38e08a0745a1b99d83d17358c6e81a464f8d
  https://chromiumcodereview.appspot.com/9340008
  https://src.chromium.org/viewvc/chrome?view=rev&revision=120671
• Vendor Specific News/Changelog Entry: http://googlechromereleases.blogspot.com/2012/02/chrome-stable-update.html
  http://security.gentoo.org/glsa/glsa-201202-01.xml
  http://www.srware.net/forum/viewtopic.php?f=18&t=3521
• Vendor Specific Advisory URL: https://code.google.com/p/chromium/issues/detail?id=112670 [ Auth Req'd ]

• Laurent Aimar