CVE-2015-8216

Publication date 17 November 2015

Last updated 24 July 2024

Ubuntu priority

Description

The ljpeg_decode_yuv_scan function in libavcodec/mjpegdec.c in FFmpeg before 2.8.2 omits certain width and height checks, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted MJPEG data.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
ffmpeg	18.04 LTS bionic	Not affected
	17.10 artful	Not affected
	17.04 zesty	Not affected
	16.10 yakkety	Not affected
	16.04 LTS xenial	Not affected
	15.10 wily	Fixed 7:2.7.3-0ubuntu0.15.10.1
	15.04 vivid	Fixed 7:2.5.9-0ubuntu0.15.04.1
	14.04 LTS trusty	Not in release
	12.04 LTS precise	Not in release
libav	18.04 LTS bionic	Not in release
	17.10 artful	Not in release
	17.04 zesty	Not in release
	16.10 yakkety	Not in release
	16.04 LTS xenial	Not in release
	15.10 wily	Not in release
	15.04 vivid	Ignored end of life
	14.04 LTS trusty	Not affected
	12.04 LTS precise	Not affected

Notes

mdeslaur

code is different in libav, marking as not-affected

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
ffmpeg	Upstream: http://git.videolan.org/?p=ffmpeg.git;a=commit;h=d24888ef19ba38b787b11d1ee091a3d94920c76a

References

Other references

https://www.cve.org/CVERecord?id=CVE-2015-8216