Multiple vulnerabilities in FFmpeg



| Updated: 2025-06-08
Risk Medium
Patch available YES
Number of vulnerabilities 2
CVE-ID CVE-2015-8365
CVE-2015-8364
CWE-ID CWE-119
CWE-20
Exploitation vector Network
Public exploit N/A
Vulnerable software
 FFmpeg
Universal components / Libraries / Libraries used by multiple products

Vendor ffmpeg.sourceforge.net

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Buffer overflow

EUVDB-ID: #VU110573

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2015-8365

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The smka_decode_frame function in libavcodec/smacker.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 does not verify that the data size is consistent with the number of channels, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Smacker data.

Mitigation

Install update from vendor's website.

Vulnerable software versions

FFmpeg: 2.6.4 - 2.8.2

CPE2.3 External links

https://git.videolan.org/?p=ffmpeg.git;a=commit;h=4a9af07a49295e014b059c1ab624c40345af5892
https://lists.opensuse.org/opensuse-updates/2015-12/msg00118.html
https://www.debian.org/security/2017/dsa-4012
https://www.ubuntu.com/usn/USN-2944-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Input validation error

EUVDB-ID: #VU110574

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2015-8364

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Integer overflow in the ff_ivi_init_planes function in libavcodec/ivi.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 allows remote attackers to cause a denial of service (out-of-bounds heap-memory access) or possibly have unspecified other impact via crafted image dimensions in Indeo Video Interactive data.

Mitigation

Install update from vendor's website.

Vulnerable software versions

FFmpeg: 2.6.4 - 2.8.2

CPE2.3 External links

https://git.videolan.org/?p=ffmpeg.git;a=commit;h=df91aa034b82b77a3c4e01791f4a2b2ff6c82066
https://lists.opensuse.org/opensuse-updates/2015-12/msg00118.html
https://www.ubuntu.com/usn/USN-2944-1
https://lists.debian.org/debian-lts-announce/2018/12/msg00009.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###