CVE-2015-6826 — Improper Input Validation in Ffmpeg

CWE-20 — Improper Input Validation6 documents6 sources
Severity
7.5HIGHNVD
EPSS
1.0%
top 22.62%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
FfmpegDebian FfmpegCanonical Ubuntu Linux
Timeline
PublishedSep 6
Latest updateApr 3

Description

The ff_rv34_decode_init_thread_copy function in libavcodec/rv34.c in FFmpeg before 2.7.2 does not initialize certain structure members, which allows remote attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via crafted (1) RV30 or (2) RV40 RealVideo data.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages3 packages

▶debiandebian/ffmpeg< ffmpeg 7:2.7.2-1 (bookworm)
▶Debianffmpeg/ffmpeg< 7:2.7.2-1+3
▶NVDffmpeg/ffmpeg2.7.1

Also affects: Ubuntu Linux 12.04

🔴Vulnerability Details

2
GHSA
GHSA-p8g9-9wx4-2qmr: The ff_rv34_decode_init_thread_copy function in libavcodec/rv34↗2022-05-14
▶
OSV
CVE-2015-6826: The ff_rv34_decode_init_thread_copy function in libavcodec/rv34↗2015-09-06
▶

📋Vendor Advisories

2
Ubuntu
Libav vulnerabilities↗2016-04-04
▶
Debian
CVE-2015-6826: ffmpeg - The ff_rv34_decode_init_thread_copy function in libavcodec/rv34.c in FFmpeg befo...↗2015
▶

📄Research Papers

1
arXiv
Dynamic Neural Control Flow Execution: An Agent-Based Deep Equilibrium Approach for Binary Vulnerability Detection↗2024-04-03
▶