PT-2015-7370 · FFmpeg · Ffmpeg

Publicado 2015-09-05 · Atualizado 2018-12-21 · CVE-2015-6818

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 2.7.2

Description The issue is related to the decode ihdr chunk function in libavcodec/pngdec.c, which does not properly enforce the uniqueness of the IHDR chunk in a PNG image. This can be exploited by remote attackers using a crafted image with multiple IHDR chunks, potentially leading to a denial of service due to out-of-bounds array access or other unspecified impacts.

Recommendations For versions prior to 2.7.2, update to version 2.7.2 or later to resolve the issue.

Correção

DoS

Enumeração de Fraquezas

CWE-17

Identificadores relacionados

CVE-2015-6818

DLA-1611-1

MGASA-2016-0018

USN-2944-1

Produtos afetados

Ffmpeg

Referências · 50

• https://ubuntu.com/security/notices/USN-2944-1 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6826 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8217 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6820 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-6818 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=17257 · Nota
• https://bdu.fstec.ru/vul/2017-01539 · Nota de Segurança
• https://advisories.mageia.org/MGASA-2016-0018.html · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10191 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8364 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6825 · Nota de Segurança
• https://bdu.fstec.ru/vul/2016-00373 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8363 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-6818 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2015-11765 · Nota de Segurança