CVE-2015-1208 — Integer Underflow (Wrap or Wraparound) in Ffmpeg

CWE-191 — Integer Underflow (Wrap or Wraparound)4 documents4 sources
Severity
5.5MEDIUMNVD
EPSS
0.2%
top 52.26%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
FfmpegDebian Ffmpeg
Timeline
PublishedJan 9
Latest updateMay 14

Description

Integer underflow in the mov_read_default function in libavformat/mov.c in FFmpeg before 2.4.6 allows remote attackers to obtain sensitive information from heap and/or stack memory via a crafted MP4 file.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages3 packages

▶NVDffmpeg/ffmpeg< 2.4.6
▶debiandebian/ffmpeg< ffmpeg 7:2.5.3-1 (bookworm)
▶Debianffmpeg/ffmpeg< 7:2.5.3-1+3

🔴Vulnerability Details

2
GHSA
GHSA-wwpv-hj37-m43g: Integer underflow in the mov_read_default function in libavformat/mov↗2022-05-14
▶
OSV
CVE-2015-1208: Integer underflow in the mov_read_default function in libavformat/mov↗2018-01-09
▶

📋Vendor Advisories

1
Debian
CVE-2015-1208: ffmpeg - Integer underflow in the mov_read_default function in libavformat/mov.c in FFmpe...↗2015
▶