CVE-2015-8662: ffmpeg
CVSS: 7.5v2.0HighModified
AliasesUBUNTU-CVE-2015-8662DEBIAN-CVE-2015-8662CGA-7gjm-mrg4-cmwgCGA-8crg-x5fc-4r3jCGA-f8c3-4cch-hr89CGA-ggg9-9vxc-h7v4CGA-gr8v-5rxp-pffcCGA-vmj6-r2vj-prm7CGA-wvfj-2g8m-xmmqCGA-xx53-99cr-jrgj
Published 24-12-2015Last modified 06-08-2024
Vulnerability summary
CVE-2015-8662 is a high (CVSS 7.5) vulnerability in ffmpeg. EPSS estimates a 1.91% chance of exploitation in the next 30 days, higher than 79.4% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v2.0 (NVD)EPSS score
1.91%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 2Timeline
- 24-12-2015PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The ff_dwt_decode function in libavcodec/jpeg2000dwt.c in FFmpeg before 2.8.4 does not validate the number of decomposition levels before proceeding with Discrete Wavelet Transform decoding, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG 2000 data.
CVSS metrics
5 scores · 4 sources · 2 versionsHigh 7.3Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated7.3HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- OSV · DebianEcosystem advisory · calculated7.3HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- OSV · ChainguardEcosystem advisory · calculated7.3HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
High 7.5Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
1.91%
Chance of exploitation in the next 30 days
Percentile
79%
Versus all other CVEs
30-day change
0.00 pp
From 1.91% on 18-09-2026
18-09-202618-10-2026
EPSS score1.91%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard4 products
- torchaudio-ffmpeg-tarballsAll versions (No fix recorded)
- torchaudio-ffmpeg-tarballs-4.4.4All versions (No fix recorded)
- torchaudio-ffmpeg-tarballs-5.0.3All versions (No fix recorded)
- torchaudio-ffmpeg-tarballs-6.0All versions (No fix recorded)
Debian1 product
- ffmpeg< 7:2.8.4-1
Ffmpeg1 product
- ffmpeg≤ 2.8.3
Ubuntu1 product
- ffmpeg< 7:2.8.4-1ubuntu1
4 vendors · 7 products
References
7 links
- lists.opensuse.org/opensuse-security-announce/2016-01/msg00004.htmlVendor AdvisoryX Refsource SUSEWEB
- git.videolan.org?p=ffmpeg.git%3Ba=commit%3Bh=75422280fbcdfbe9dc56bde5525b4d8b280f1bc5X Refsource CONFIRMWEB