CVE:CVE-2011-3362
CNNVD:CNNVD-201110-004
FFmpeg是FFmpeg团队的一套可录制、转换以及流化音视频的完整解决方案。
FFmpeg 0.7.3之前版本和0.8.2之前的0.8.x版本以及libav 至0.7.1版本中的libavcodec中的cavsdec.c的decode_residual_block函数中存在整数符号错误。远程攻击者可借助特制Chinese AVS video (也称为CAVS)文件导致拒绝服务（内存破坏以及应用程序崩溃）或者可能执行任意代码。
solution:Upgrade ffmpeg ffmpeg to a higher version than 0.7.2,0.3,0.3.1,0.3.2,0.3.3,0.3.4,0.4.0,0.4.2,0.4.3,0.4.4,0.4.5,0.4.6,0.4.7,0.4.8,0.4.9:pre1,0.5,0.5.1,0.5.2,0.5.3,0.5.4,0.6,0.6.1,0.6.2,0.7.1,0.8.0,0.8.1,and avoid the version (,0.7.2],0.3,0.3.1,0.3.2,0.3.3,0.3.4,0.4.0,0.4.2,0.4.3,0.4.4,0.4.5,0.4.6,0.4.7,0.4.8,0.4.9:pre1,0.5,0.5.1,0.5.2,0.5.3,0.5.4,0.6,0.6.1,0.6.2,0.7.1,0.8.0,0.8.1; Upgrade libav libav to a higher version than 0.7.1,0.3,0.3.1,0.3.2,0.3.3,0.3.4,0.4.0,0.4.1,0.4.2,0.4.3,0.4.4,0.4.5,0.4.6,0.4.7,0.4.8,0.4.9:pre1,0.5,0.5.4,0.6,0.6.1,0.6.2,0.7:beta1,0.7:beta2,and avoid the version (,0.7.1],0.3,0.3.1,0.3.2,0.3.3,0.3.4,0.4.0,0.4.1,0.4.2,0.4.3,0.4.4,0.4.5,0.4.6,0.4.7,0.4.8,0.4.9:pre1,0.5,0.5.4,0.6,0.6.1,0.6.2,0.7:beta1,0.7:beta2