PT-2015-3157 · FFmpeg+1 · Ffmpeg+1
Publicado
2015-12-24
·
Atualizado
2024-06-15
·
CVE-2015-8661
CVSS v3.1
8.3
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
FFmpeg versions prior to 2.8.3
Description
The issue is related to the h264 slice header init function in libavcodec/h264 slice.c, which does not properly validate the relationship between the number of threads and the number of slices. This can be exploited by remote attackers using crafted H.264 data, potentially leading to a denial of service due to out-of-bounds array access or other unspecified impacts.
Recommendations
For versions prior to 2.8.3, update to version 2.8.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of the h264 slice header init function until a patch is available.
Correção
DoS
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Ffmpeg
Suse