CVE-2015-8365

2015-11-2617:59:00

CWE-119

[email protected]

web.nvd.nist.gov

cve-2015-8365

ffmpeg

smka_decode_frame

libavcodec

denial of service

out-of-bounds array access

security vulnerability

9.3 High

AI Score

Confidence

High

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.004 Low

EPSS

Percentile

72.3%

JSON

The smka_decode_frame function in libavcodec/smacker.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 does not verify that the data size is consistent with the number of channels, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Smacker data.

CPENameOperatorVersion
canonical:ubuntu_linuxcanonical ubuntu linuxeq12.04
ffmpeg:ffmpegffmpegeq2.7.1
ffmpeg:ffmpegffmpegeq2.7.0
ffmpeg:ffmpegffmpegeq2.8.2
ffmpeg:ffmpegffmpegeq2.8.1
ffmpeg:ffmpegffmpegeq2.6.4
ffmpeg:ffmpegffmpegeq2.7.2
ffmpeg:ffmpegffmpegeq2.8.0

CPE	Name	Operator	Version
canonical:ubuntu_linux	canonical ubuntu linux	eq	12.04
ffmpeg:ffmpeg	ffmpeg	eq	2.7.1
ffmpeg:ffmpeg	ffmpeg	eq	2.7.0
ffmpeg:ffmpeg	ffmpeg	eq	2.8.2
ffmpeg:ffmpeg	ffmpeg	eq	2.8.1
ffmpeg:ffmpeg	ffmpeg	eq	2.6.4
ffmpeg:ffmpeg	ffmpeg	eq	2.7.2
ffmpeg:ffmpeg	ffmpeg	eq	2.8.0