NetSight
IP …
medium6.8

CVE-2015-8365

The smka_decode_frame function in libavcodec/smacker.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 does not verify that the data size i…

Impact

The smka_decode_frame function in libavcodec/smacker.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 does not verify that the data size is consistent with the number of channels, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Smacker data.

Affected products

VendorProductAffected versions
CanonicalUbuntu Linux
Version 12.04
FfmpegFfmpeg
Versions 2.6.4, 2.7.0, 2.7.1, 2.7.2, 2.8.0, 2.8.1

Weakness classification

CWE-119

References