Vulnerability Details : CVE-2015-1208
Integer underflow in the mov_read_default function in libavformat/mov.c in FFmpeg before 2.4.6 allows remote attackers to obtain sensitive information from heap and/or stack memory via a crafted MP4 file.
Products affected by CVE-2015-1208
- cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2015-1208
0.27%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 66 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2015-1208
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:N/A:N |
8.6
|
2.9
|
NIST | |
|
5.5
|
MEDIUM | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
1.8
|
3.6
|
NIST |
CWE ids for CVE-2015-1208
-
The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-1208
-
http://git.videolan.org/?p=ffmpeg.git;a=commit;h=3ebd76a9c57558e284e94da367dd23b435e6a6d0
git.videolan.org Git - ffmpeg.git/commitThird Party Advisory
-
https://bugs.chromium.org/p/chromium/issues/detail?id=444546
444546 - Heap/Stack Memory Info Leak - FFMPEG libavformat\mov.c - chromium - MonorailThird Party Advisory
-
https://github.com/FFmpeg/FFmpeg/blob/n2.4.6/Changelog
FFmpeg/Changelog at n2.4.6 · FFmpeg/FFmpeg · GitHubThird Party Advisory
Jump to