Vulnerability Details : CVE-2015-3417
Use-after-free vulnerability in the ff_h264_free_tables function in libavcodec/h264.c in FFmpeg before 2.3.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted H.264 data in an MP4 file, as demonstrated by an HTML VIDEO element that references H.264 data.
Vulnerability category: Memory CorruptionDenial of service
Products affected by CVE-2015-3417
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2015-3417
6.12%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 93 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2015-3417
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST |
References for CVE-2015-3417
-
https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.4
git.libav.org Git - libav.git/blob - ChangelogRelease Notes;Vendor Advisory
-
http://seclists.org/fulldisclosure/2015/Apr/31
Full Disclosure: several issues in SQLite (+ catching up on several other bugs)Third Party Advisory;VDB Entry
-
https://github.com/FFmpeg/FFmpeg/commit/e8714f6f93d1a32f4e4655209960afcf4c185214
avcodec/h264: Clear delayed_pic on deallocation · FFmpeg/FFmpeg@e8714f6 · GitHubPatch;Vendor Advisory
-
https://security.gentoo.org/glsa/201705-08
libav: Multiple vulnerabilities (GLSA 201705-08) — Gentoo security
-
http://www.securityfocus.com/bid/74385
FFmpeg 'libavcodec/h264.c' Use After Free Denial of Service VulnerabilityThird Party Advisory;VDB Entry
-
http://www.securitytracker.com/id/1032198
FFmpeg Use-After-Free Memory Error in ff_h264_free_tables() Lets Remote Users Deny Service - SecurityTrackerThird Party Advisory;VDB Entry
-
http://www.debian.org/security/2015/dsa-3288
Debian -- Security Information -- DSA-3288-1 libavThird Party Advisory
Jump to