Description
libavcodec/vorbis_dec.c in the Vorbis decoder in FFmpeg 0.6.1 and earlier allows remote attackers to cause a denial of service (application crash) via a crafted .ogg file, related to the vorbis_floor0_decode function. NOTE: this might overlap CVE-2011-0480.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ffmpeg | 7:2.4.1-1 | — |
| Debian 13 | ffmpeg | 7:2.4.1-1 | — |
| Debian 12 | ffmpeg | 7:2.4.1-1 | — |
| Debian 6.0 | ffmpeg | 4:0.5.4-1 | DSA-2306-1 |
| Debian 5.0 | ffmpeg-debian | 0.svn20080206-18+lenny3 | DSA-2165-1 |
Advisories 2
- DSA-2306-1 ffmpeg - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-2165-1 ffmpeg-debian - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
References
- MDVSA-2011:088 vendor-advisory
- DSA-2306 vendor-advisory
- MDVSA-2011:061 vendor-advisory
- https://roundup.ffmpeg.org/issue2322
- MDVSA-2011:062 vendor-advisory
- MDVSA-2011:112 vendor-advisory
- MDVSA-2011:114 vendor-advisory
- 43323 third-party-advisory
- USN-1104-1 vendor-advisory
- MDVSA-2011:089 vendor-advisory
- http://ffmpeg.mplayerhq.hu/
- http://git.ffmpeg.org/?p=ffmpeg.git%3Ba=commit%3Bh=3dde66752d59dfdd0f3727efd66e7202b3c75078
- DSA-2165 vendor-advisory
- ADV-2011-1241 vdb-entry
- 46294 vdb-entry
- MDVSA-2011:060 vendor-advisory