CVE-2015-3395
Fixed in a distro release EPSS 2%
The msrle_decode_pal4 function in msrledec.c in Libav before 10.7 and 11.x before 11.4 and FFmpeg before 2.0.7, 2.2.x before 2.2.15, 2.4.x before 2.4.8, 2.5.x before 2.5.6, and 2.6.x before 2.6.2 allows remote attackers to have unspecified impact via a crafted image, related to a pixel pointer, which triggers an out-of-bounds array access.
Products: canonical ubuntu_linux, ffmpeg, libav
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | ffmpeg | 7:2.6.2-1 |
| Debian 13 | ffmpeg | 7:2.6.2-1 |
| Debian 14 | ffmpeg | 7:2.6.2-1 |
| Debian 8 | libav | 6:11.4-1~deb8u1 |
| Ubuntu 14.04 LTS | chromium-browser | 47.0.2526.73-0ubuntu0.14.04.1.1106 |
| Ubuntu 16.04 LTS | chromium-browser | 47.0.2526.73-0ubuntu1.1218 |
| Ubuntu Pro 14.04 LTS | libav | 6:9.20-0ubuntu0.14.04.1+esm1 |
| openSUSE Tumbleweed | libav-tools | 12.3-1.17 |