PT-2015-7372 · FFmpeg · Ffmpeg

Publicado

2015-09-05

·

Atualizado

2018-12-21

·

CVE-2015-6820

CVSS v2.0

7.5

Alta

VetorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 2.7.2
Description The issue is related to the ff sbr apply function in libavcodec/aacsbr.c, which does not properly check for a matching AAC frame syntax element before performing Spectral Band Replication calculations. This can be exploited by remote attackers using crafted AAC data, potentially leading to a denial of service due to out-of-bounds array access or other unspecified impacts.
Recommendations For versions prior to 2.7.2, update to version 2.7.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of the ff sbr apply function until a patch is available.

Correção

DoS

Buffer Overflow

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2015-6820
DLA-1611-1
MGASA-2016-0018
USN-2944-1

Produtos afetados

Ffmpeg