CVE-2015-8365
Last modified
CVE-2015-8365 is a vulnerability of currently unknown severity. The smka_decode_frame function in libavcodec/smacker.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 does not verify that the data size is consistent with the number of channels, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Smacker data.. EPSS estimates a 2.08% chance of exploitation in the next 30 days.
Description
The smka_decode_frame function in libavcodec/smacker.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 does not verify that the data size is consistent with the number of channels, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Smacker data.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Canonical | Ubuntu Linux | 12.04 |
| Ffmpeg | Ffmpeg | 2.6.4 |
| Ffmpeg | Ffmpeg | 2.7.0 |
| Ffmpeg | Ffmpeg | 2.7.1 |
| Ffmpeg | Ffmpeg | 2.7.2 |
| Ffmpeg | Ffmpeg | 2.8.0 |
| Ffmpeg | Ffmpeg | 2.8.1 |
| Ffmpeg | Ffmpeg | 2.8.2 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2015-8365?
How severe is CVE-2015-8365?
How do I fix CVE-2015-8365?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2015
- CVE-2015-8358Directory traversal vulnerability in the bitrix.mpbuilder mo…
- CVE-2015-8360An unspecified resource in Atlassian Bamboo before 5.9.9 and…
- CVE-2015-8361Multiple unspecified services in Atlassian Bamboo before 5.9…
- CVE-2015-8362The setUpSubtleUserAccount function in /bin/bw on Harman AMX…
- CVE-2015-8363The jpeg2000_read_main_headers function in libavcodec/jpeg20…
- CVE-2015-8364Integer overflow in the ff_ivi_init_planes function in libav…
- CVE-2015-8366Array index error in smal_decode_segment function in LibRaw …9.8
- CVE-2015-8367The phase_one_correct function in Libraw before 0.17.1 allow…9.8
- CVE-2015-8368ntopng (aka ntop) before 2.2 allows remote authenticated use…
- CVE-2015-8369SQL injection vulnerability in include/top_graph_header.php …
- CVE-2015-8370Multiple integer underflows in Grub2 1.98 through 2.02 allow…7.4
- CVE-2015-8371Composer before 2016-02-10 allows cache poisoning from other…8.8
Are you affected by CVE-2015-8365?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST