CVE-2015-6822

FFmpeg < 2.7.2 - Denial of Service via Crafted LucasArts Smush Video Data

Title source: llm
STIX 2.1

Description

The destroy_buffers function in libavcodec/sanm.c in FFmpeg before 2.7.2 does not properly maintain height and width values in the video context, which allows remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via crafted LucasArts Smush video data.

References (5)

Core 5
Core References
Mailing List mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2018/12/msg00009.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1033483
Mailing List mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2018/12/msg00010.html
Various Sources x_refsource_confirm
http://ffmpeg.org/security.html

Scores

EPSS 0.0089
EPSS Percentile 75.7%

Details

CWE
CWE-17
Status published
Products (1)
ffmpeg/ffmpeg < 2.7.1
Published Sep 06, 2015
Tracked Since Feb 18, 2026