The smka_decode_frame function in libavcodec/smacker.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 does not verify that the data size is consistent with the number of channels, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Smacker data.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade ffmpegUpgrade libav | Nov 1, 2017 | Nov 26, 2015 |
| Ffmpeg | — | Upgrade to FFmpeg version 2.6.5Upgrade to FFmpeg version 2.8.3Upgrade to FFmpeg version 2.5.9Upgrade to FFmpeg version 2.7.3Upgrade to FFmpeg version 2.4.12 | Sep 29, 2017 | Nov 26, 2015 |
| Freebsd | — | Upgrade mplayerUpgrade avidemux2Upgrade ffmpeg2Upgrade mencoderUpgrade plexhometheaterUpgrade libavUpgrade ffmpegUpgrade ffmpeg24Upgrade mythtv-frontendUpgrade mythtvUpgrade handbrakeUpgrade ffmpeg26Upgrade kodiUpgrade ffmpeg-develUpgrade ffmpeg-011Upgrade avidemuxUpgrade gstreamer-ffmpegUpgrade ffmpeg1Upgrade ffmpeg23Upgrade ffmpeg25Upgrade ffmpeg0Upgrade avidemux26 | Dec 10, 2025 | Dec 2, 2015 |
| Suse | — | Upgrade libavfilter6Upgrade libavcodec57Upgrade libavutil-develUpgrade libavresample3Upgrade libpostproc54Upgrade libpostproc-develUpgrade libavutil55Upgrade libavcodec-develUpgrade libswresample2Upgrade libavformat57Upgrade libswresample-develUpgrade libavformat-develUpgrade ffmpegUpgrade libavdevice57Upgrade libavresample-develUpgrade libswscale4Upgrade libswscale-devel | Jan 4, 2016 | Nov 26, 2015 |
| Ubuntu | — | Upgrade libavcodec53Upgrade libavformat53 | Apr 4, 2016 | Nov 26, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub