PT-2015-7377 · FFmpeg · Ffmpeg

Published 2015-09-06 · Updated 2018-12-21 · CVE-2015-6825

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 2.7.2

Description The issue is related to the ff frame thread init function in libavcodec/pthread frame.c, which mishandles certain memory-allocation failures. This can be exploited by remote attackers using a crafted file, such as an AVI file, to cause a denial of service due to invalid pointer access, or possibly have other unspecified impacts.

Recommendations For versions prior to 2.7.2, update to version 2.7.2 or later to resolve the issue. As a temporary workaround, consider restricting access to files that could potentially exploit this issue until the update is applied.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2015-6825

DLA-1611-1

MGASA-2016-0018

Affected Products

Ffmpeg

References · 48

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6826 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8217 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6820 · Security Note
• https://bdu.fstec.ru/vul/2017-01539 · Security Note
• https://advisories.mageia.org/MGASA-2016-0018.html · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10191 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8364 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6825 · Security Note
• https://bdu.fstec.ru/vul/2016-00373 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8363 · Security Note
• https://bdu.fstec.ru/vul/2015-11765 · Security Note
• https://cve.org/CVERecord?id=CVE-2015-6825 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-6825 · Security Note
• https://security-tracker.debian.org/tracker/source-package/libav · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9317 · Security Note