CVE-2015-3417: debian debian_linux
Vulnerability summary
CVE-2015-3417 is a medium (CVSS 6.8) vulnerability in debian debian_linux. EPSS estimates a 2.55% chance of exploitation in the next 30 days, higher than 84.8% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 4 · Related 1Timeline
- 24-04-2015PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Use-after-free vulnerability in the ff_h264_free_tables function in libavcodec/h264.c in FFmpeg before 2.3.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted H.264 data in an MP4 file, as demonstrated by an HTML VIDEO element that references H.264 data.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
2.55%
Chance of exploitation in the next 30 days
Percentile
85%
Versus all other CVEs
30-day change
0.00 pp
From 2.55% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Chainguard4 products
- torchaudio-ffmpeg-tarballsAll versions (No fix recorded)
- torchaudio-ffmpeg-tarballs-4.4.4All versions (No fix recorded)
- torchaudio-ffmpeg-tarballs-5.0.3All versions (No fix recorded)
- torchaudio-ffmpeg-tarballs-6.0All versions (No fix recorded)
Debian2 products
- ffmpeg< 7:2.6.1-1
- debian_linuxEOL8.0
Ffmpeg1 product
- ffmpeg≤ 2.3.5
Ubuntu1 product
- libav< 6:9.20-0ubuntu0.14.04.1+esm1
4 vendors · 8 products
References
10 links- git.libav.org?p=libav.git%3Ba=blob%3Bf=Changelog%3Bhb=refs/tags/v11.4X Refsource CONFIRM
- github.com/FFmpeg/FFmpeg/commit/e8714f6f93d1a32f4e4655209960afcf4c185214X Refsource CONFIRMPatchVendor Advisory
- seclists.org/fulldisclosure/2015/Apr/31Mailing ListX Refsource FULLDISCThird Party AdvisoryVDB EntryREPORT