PT-2015-2760 · FFmpeg · Ffmpeg

Publicado 2015-11-17 · Atualizado 2024-06-15 · CVE-2015-8217

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 2.8.2

Description The issue is related to the ff hevc parse sps function in libavcodec/hevc ps.c, which does not properly validate the Chroma Format Indicator. This allows remote attackers to cause a denial of service, potentially through out-of-bounds array access, by using specially crafted High Efficiency Video Coding (HEVC) data.

Recommendations For versions prior to 2.8.2, update to version 2.8.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of the ff hevc parse sps function until a patch is applied.

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2015-12125

CVE-2015-8217

DLA-1611-1

OPENSUSE-SU-2024:10243-1

OPENSUSE-SU-2024:10754-1

Produtos afetados

Ffmpeg

Referências · 90

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6820 · Nota de Segurança
• https://suse.com/security/cve/CVE-2015-8217 · Nota
• https://suse.com/security/cve/CVE-2017-14222 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10191 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6825 · Nota de Segurança
• https://bdu.fstec.ru/vul/2016-00373 · Nota de Segurança
• https://suse.com/security/cve/CVE-2016-10191 · Nota
• https://suse.com/security/cve/CVE-2015-8363 · Nota
• https://bdu.fstec.ru/vul/2015-11765 · Nota de Segurança
• https://suse.com/security/cve/CVE-2019-11338 · Nota
• https://suse.com/security/cve/CVE-2018-7751 · Nota
• https://suse.com/security/cve/CVE-2018-13300 · Nota
• https://security-tracker.debian.org/tracker/source-package/libav · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8216 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6761 · Nota de Segurança