CVE-2015-6826

2015-09-0602:59:09

CWE-20

mitre

web.nvd.nist.gov

cve-2015-6826

ffmpeg

denial of service

invalid pointer access

rv30

rv40

realvideo

nvd

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

8.8

Confidence

High

EPSS

0.006

Percentile

78.2%

JSON

The ff_rv34_decode_init_thread_copy function in libavcodec/rv34.c in FFmpeg before 2.7.2 does not initialize certain structure members, which allows remote attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via crafted (1) RV30 or (2) RV40 RealVideo data.

Affected configurations

Nvd

Node

canonicalubuntu_linuxMatch12.04lts

Node

ffmpegffmpegRange≤2.7.1

VendorProductVersionCPE
canonicalubuntu_linux12.04cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
ffmpegffmpeg*cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*