CVE-2015-8365

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 2.6.5 FFmpeg versions 2.7.x prior to 2.7.3 FFmpeg versions 2.8.x through 2.8.2

Description The issue is related to the smka decode frame function in libavcodec/smacker.c, which does not verify that the data size is consistent with the number of channels. This allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Smacker data.

Recommendations For FFmpeg versions prior to 2.6.5, update to version 2.6.5 or later. For FFmpeg versions 2.7.x prior to 2.7.3, update to version 2.7.3 or later. For FFmpeg versions 2.8.x through 2.8.2, update to a version later than 2.8.2.