PT-2015-2760 · FFmpeg · Ffmpeg

Published 2015-11-17 · Updated 2024-06-15 · CVE-2015-8217

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 2.8.2

Description The issue is related to the ff hevc parse sps function in libavcodec/hevc ps.c, which does not properly validate the Chroma Format Indicator. This allows remote attackers to cause a denial of service, potentially through out-of-bounds array access, by using specially crafted High Efficiency Video Coding (HEVC) data.

Recommendations For versions prior to 2.8.2, update to version 2.8.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of the ff hevc parse sps function until a patch is applied.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2015-12125

CVE-2015-8217

DLA-1611-1

OPENSUSE-SU-2024:10243-1

OPENSUSE-SU-2024:10754-1

Affected Products

Ffmpeg

References · 90

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6820 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10191 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6825 · Security Note
• https://bdu.fstec.ru/vul/2016-00373 · Security Note
• https://bdu.fstec.ru/vul/2015-11765 · Security Note
• https://security-tracker.debian.org/tracker/source-package/libav · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8216 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6761 · Security Note
• https://cve.org/CVERecord?id=CVE-2015-8217 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6822 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8663 · Security Note
• https://security-tracker.debian.org/tracker/DLA-1611-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1611-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2015-11/msg00146.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6818 · Security Note