CVE-2015-6823 - Vulnerability Details - OpenCVE

The allocate_buffers function in libavcodec/alac.c in FFmpeg before 2.7.2 does not initialize certain context data, which allows remote attackers to cause a denial of service (segmentation violation) or possibly have unspecified other impact via crafted Apple Lossless Audio Codec (ALAC) data.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Ffmpeg	Ffmpeg

Configuration 1 [-]

cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://ffmpeg.org/security.html
http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=f7068bf277a37479aecde2832208d820682b35e6
http://www.securitytracker.com/id/1033483
https://lists.debian.org/debian-lts-announce/2018/12/msg00010.html

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2015-09-06T01:00:00

Updated: 2024-08-06T07:29:25.192Z

Reserved: 2015-09-05T00:00:00

Link: CVE-2015-6823

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2015-09-06T02:59:06.313

Modified: 2025-04-12T10:46:40.837

Link: CVE-2015-6823

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2015-07-18T00:00:00", "descriptions": [{"lang": "en", "value": "The allocate_buffers function in libavcodec/alac.c in FFmpeg before 2.7.2 does not initialize certain context data, which allows remote attackers to cause a denial of service (segmentation violation) or possibly have unspecified other impact via crafted Apple Lossless Audio Codec (ALAC) data."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-12-21T10:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=f7068bf277a37479aecde2832208d820682b35e6"}, {"name": "1033483", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1033483"}, {"name": "[debian-lts-announce] 20181221 [SECURITY] [DLA 1611-2] libav security update", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.debian.org/debian-lts-announce/2018/12/msg00010.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://ffmpeg.org/security.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2015-6823", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The allocate_buffers function in libavcodec/alac.c in FFmpeg before 2.7.2 does not initialize certain context data, which allows remote attackers to cause a denial of service (segmentation violation) or possibly have unspecified other impact via crafted Apple Lossless Audio Codec (ALAC) data."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://git.videolan.org/?p=ffmpeg.git;a=commit;h=f7068bf277a37479aecde2832208d820682b35e6", "refsource": "CONFIRM", "url": "http://git.videolan.org/?p=ffmpeg.git;a=commit;h=f7068bf277a37479aecde2832208d820682b35e6"}, {"name": "1033483", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1033483"}, {"name": "[debian-lts-announce] 20181221 [SECURITY] [DLA 1611-2] libav security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2018/12/msg00010.html"}, {"name": "http://ffmpeg.org/security.html", "refsource": "CONFIRM", "url": "http://ffmpeg.org/security.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T07:29:25.192Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=f7068bf277a37479aecde2832208d820682b35e6"}, {"name": "1033483", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1033483"}, {"name": "[debian-lts-announce] 20181221 [SECURITY] [DLA 1611-2] libav security update", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2018/12/msg00010.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://ffmpeg.org/security.html"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2015-6823", "datePublished": "2015-09-06T01:00:00", "dateReserved": "2015-09-05T00:00:00", "dateUpdated": "2024-08-06T07:29:25.192Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*", "matchCriteriaId": "1F6121E6-4C3F-42F3-8627-709534D9A0C9", "versionEndIncluding": "2.7.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The allocate_buffers function in libavcodec/alac.c in FFmpeg before 2.7.2 does not initialize certain context data, which allows remote attackers to cause a denial of service (segmentation violation) or possibly have unspecified other impact via crafted Apple Lossless Audio Codec (ALAC) data."}, {"lang": "es", "value": "Vulnerabilidad en la funci\u00f3n allocate_buffers en libavcodec/alac.c en FFmpeg en versiones anteriores a 2.7.2, no inicializa ciertos datos de contexto, lo que permite a atacantes remotos causar una denegaci\u00f3n de servicio (violaci\u00f3n de segmentaci\u00f3n) o posiblemente tener otro impacto no especificado a trav\u00e9s de datos Apple Lossless Audio Codec (ALAC) manipulados."}], "id": "CVE-2015-6823", "lastModified": "2025-04-12T10:46:40.837", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2015-09-06T02:59:06.313", "references": [{"source": "cve@mitre.org", "url": "http://ffmpeg.org/security.html"}, {"source": "cve@mitre.org", "url": "http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=f7068bf277a37479aecde2832208d820682b35e6"}, {"source": "cve@mitre.org", "url": "http://www.securitytracker.com/id/1033483"}, {"source": "cve@mitre.org", "url": "https://lists.debian.org/debian-lts-announce/2018/12/msg00010.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://ffmpeg.org/security.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=f7068bf277a37479aecde2832208d820682b35e6"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securitytracker.com/id/1033483"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2018/12/msg00010.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-17"}], "source": "nvd@nist.gov", "type": "Primary"}]}