PT-2015-7372 · FFmpeg · Ffmpeg

Published 2015-09-05 · Updated 2018-12-21 · CVE-2015-6820

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 2.7.2

Description The issue is related to the ff sbr apply function in libavcodec/aacsbr.c, which does not properly check for a matching AAC frame syntax element before performing Spectral Band Replication calculations. This can be exploited by remote attackers using crafted AAC data, potentially leading to a denial of service due to out-of-bounds array access or other unspecified impacts.

Recommendations For versions prior to 2.7.2, update to version 2.7.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of the ff sbr apply function until a patch is available.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2015-6820

DLA-1611-1

MGASA-2016-0018

USN-2944-1

Affected Products

Ffmpeg

References · 50

• https://ubuntu.com/security/notices/USN-2944-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6826 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8217 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6820 · Security Note
• https://bdu.fstec.ru/vul/2017-01539 · Security Note
• https://advisories.mageia.org/MGASA-2016-0018.html · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10191 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8364 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6825 · Security Note
• https://ubuntu.com/security/CVE-2015-6820 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-00373 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8363 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-6820 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-11765 · Security Note
• http://ubuntu.com/usn/USN-2944-1 · Vendor Advisory