PT-2015-7370 · FFmpeg · Ffmpeg

Published 2015-09-05 · Updated 2018-12-21 · CVE-2015-6818

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 2.7.2

Description The issue is related to the decode ihdr chunk function in libavcodec/pngdec.c, which does not properly enforce the uniqueness of the IHDR chunk in a PNG image. This can be exploited by remote attackers using a crafted image with multiple IHDR chunks, potentially leading to a denial of service due to out-of-bounds array access or other unspecified impacts.

Recommendations For versions prior to 2.7.2, update to version 2.7.2 or later to resolve the issue.

Fix

DoS

Weakness Enumeration

CWE-17

Related Identifiers

CVE-2015-6818

DLA-1611-1

MGASA-2016-0018

USN-2944-1

Affected Products

Ffmpeg

References · 50

• https://ubuntu.com/security/notices/USN-2944-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6826 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8217 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6820 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-6818 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-01539 · Security Note
• https://advisories.mageia.org/MGASA-2016-0018.html · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10191 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8364 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6825 · Security Note
• https://bdu.fstec.ru/vul/2016-00373 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8363 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-6818 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-11765 · Security Note
• https://security-tracker.debian.org/tracker/source-package/libav · Vendor Advisory