Your submission was sent successfully! Close

You have successfully unsubscribed! Close

CVE-2015-8364

Published: 26 November 2015

Integer overflow in the ff_ivi_init_planes function in libavcodec/ivi.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 allows remote attackers to cause a denial of service (out-of-bounds heap-memory access) or possibly have unspecified other impact via crafted image dimensions in Indeo Video Interactive data.

Notes

AuthorNote
mdeslaur
no equivalent fix in libav as of 2016-03-31
in precise, code is in ivi_common.c
ebarretto
as of 2018-09-27, no equivalent fix in libav

Priority

Medium

Status

Package Release Status
ffmpeg
Launchpad, Ubuntu, Debian
artful Not vulnerable
(7:2.8.3-1)
bionic Not vulnerable
(7:2.8.3-1)
precise Does not exist

trusty Does not exist

upstream Needs triage

vivid Not vulnerable
(code not present)
wily Not vulnerable
(7:2.7.3-0ubuntu0.15.10.1)
xenial Not vulnerable
(7:2.8.3-1)
yakkety Not vulnerable
(7:2.8.3-1)
zesty Not vulnerable
(7:2.8.3-1)
Patches:
upstream: http://git.videolan.org/?p=ffmpeg.git;a=commit;h=df91aa034b82b77a3c4e01791f4a2b2ff6c82066
libav
Launchpad, Ubuntu, Debian
artful Does not exist

bionic Does not exist

precise Does not exist
(precise was released [4:0.8.17-0ubuntu0.12.04.2])
trusty Ignored

upstream Needs triage

vivid Ignored
(reached end-of-life)
wily Does not exist

xenial Does not exist

yakkety Does not exist

zesty Does not exist