PT-2015-7772 · FFmpeg · Ffmpeg

Published 2015-11-26 · Updated 2018-12-21 · CVE-2015-8364

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 2.6.5 FFmpeg versions 2.7.x prior to 2.7.3 FFmpeg versions 2.8.x through 2.8.2

Description The issue is related to an integer overflow in the ff ivi init planes function, which can be triggered by crafted image dimensions in Indeo Video Interactive data. This can lead to a denial of service due to out-of-bounds heap-memory access, and potentially have other unspecified impacts.

Recommendations For FFmpeg versions prior to 2.6.5, update to version 2.6.5 or later. For FFmpeg versions 2.7.x prior to 2.7.3, update to version 2.7.3 or later. For FFmpeg versions 2.8.x through 2.8.2, update to a version later than 2.8.2.

Fix

DoS

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2015-8364

DLA-1611-1

MGASA-2016-0018

OPENSUSE-SU-2024:10243-1

USN-2944-1

Affected Products

Ffmpeg

References · 50

• https://ubuntu.com/security/notices/USN-2944-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6826 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8217 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6820 · Security Note
• https://bdu.fstec.ru/vul/2017-01539 · Security Note
• https://advisories.mageia.org/MGASA-2016-0018.html · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10191 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8364 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6825 · Security Note
• https://bdu.fstec.ru/vul/2016-00373 · Security Note
• https://ubuntu.com/security/CVE-2015-8364 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-8364 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8363 · Security Note
• https://bdu.fstec.ru/vul/2015-11765 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-8364 · Vendor Advisory