CVE-2015-3395
published 2015-06-16CVE-2015-3395: The msrle_decode_pal4 function in msrledec.c in Libav before 10.7 and 11.x before 11.4 and FFmpeg before 2.0.7, 2.2.x before 2.2.15, 2.4.x before 2.4.8, 2.5.x…
PriorityP434medium6.8CVSS 2.0
AVNACMAuNCPIPAP
EPSS
2.39%
82.2th percentile
The msrle_decode_pal4 function in msrledec.c in Libav before 10.7 and 11.x before 11.4 and FFmpeg before 2.0.7, 2.2.x before 2.2.15, 2.4.x before 2.4.8, 2.5.x before 2.5.6, and 2.6.x before 2.6.2 allows remote attackers to have unspecified impact via a crafted image, related to a pixel pointer, which triggers an out-of-bounds array access.
Affected
43 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| debian | ffmpeg | < ffmpeg 7:2.6.2-1 (bookworm) | ffmpeg 7:2.6.2-1 (bookworm) |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
CVSS provenance
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv6.8MEDIUM
vendor_debian6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Libav vulnerabilities
vendor_ubuntu·2016-04-04
CVE-2014-8541 Libav vulnerabilities
Title: Libav vulnerabilities
Summary: Libav could be made to crash or run programs as your login if it opened a
specially crafted file.
It was discovered that Libav incorrectly handled certain malformed media
files. If a user were tricked into opening a crafted media file, an
attacker could cause a denial of service via application crash, or possibly
execute arbitrary code with the privileges of the user invoking the
program.
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2015-3395: ffmpeg - The msrle_decode_pal4 function in msrledec.c in Libav before 10.7 and 11.x befor...
vendor_debian·2015·CVSS 6.8
CVE-2015-3395 [MEDIUM] CVE-2015-3395: ffmpeg - The msrle_decode_pal4 function in msrledec.c in Libav before 10.7 and 11.x befor...
The msrle_decode_pal4 function in msrledec.c in Libav before 10.7 and 11.x before 11.4 and FFmpeg before 2.0.7, 2.2.x before 2.2.15, 2.4.x before 2.4.8, 2.5.x before 2.5.6, and 2.6.x before 2.6.2 allows remote attackers to have unspecified impact via a crafted image, related to a pixel pointer, which triggers an out-of-bounds array access.
Scope: local
bookworm: resolved (fixed in 7:2.6.2-1)
bullseye: resolved (fixed in 7:2.6.2-1)
forky: resolved (fixed in 7:2.6.2-1)
sid: resolved (fixed in 7:2.6.2-1)
trixie: resolved (fixed in 7:2.6.2-1)
GHSA
GHSA-h626-6f8j-9rc9: The msrle_decode_pal4 function in msrledec
ghsa_unreviewed·2022-05-17
CVE-2015-3395 [MEDIUM] CWE-119 GHSA-h626-6f8j-9rc9: The msrle_decode_pal4 function in msrledec
The msrle_decode_pal4 function in msrledec.c in Libav before 10.7 and 11.x before 11.4 and FFmpeg before 2.0.7, 2.2.x before 2.2.15, 2.4.x before 2.4.8, 2.5.x before 2.5.6, and 2.6.x before 2.6.2 allows remote attackers to have unspecified impact via a crafted image, related to a pixel pointer, which triggers an out-of-bounds array access.
OSV
CVE-2015-3395: The msrle_decode_pal4 function in msrledec
osv·2015-06-16·CVSS 6.8
CVE-2015-3395 [MEDIUM] CVE-2015-3395: The msrle_decode_pal4 function in msrledec
The msrle_decode_pal4 function in msrledec.c in Libav before 10.7 and 11.x before 11.4 and FFmpeg before 2.0.7, 2.2.x before 2.2.15, 2.4.x before 2.4.8, 2.5.x before 2.5.6, and 2.6.x before 2.6.2 allows remote attackers to have unspecified impact via a crafted image, related to a pixel pointer, which triggers an out-of-bounds array access.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=f7e1367f58263593e6cee3c282f7277d7ee9d553http://www.debian.org/security/2015/dsa-3288http://www.securityfocus.com/bid/74433http://www.ubuntu.com/usn/USN-2944-1https://git.libav.org/?p=libav.git%3Ba=blob%3Bf=Changelog%3Bhb=refs/tags/v11.4https://security.gentoo.org/glsa/201603-06https://security.gentoo.org/glsa/201705-08https://www.ffmpeg.org/security.htmlhttp://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=f7e1367f58263593e6cee3c282f7277d7ee9d553http://www.debian.org/security/2015/dsa-3288http://www.securityfocus.com/bid/74433http://www.ubuntu.com/usn/USN-2944-1https://git.libav.org/?p=libav.git%3Ba=blob%3Bf=Changelog%3Bhb=refs/tags/v11.4https://security.gentoo.org/glsa/201603-06https://security.gentoo.org/glsa/201705-08https://www.ffmpeg.org/security.html
2015-06-16
Published