CVE-2015-6822
The destroy_buffers function in libavcodec/sanm.c in FFmpeg before 2.7.2 does not properly...
The destroy_buffers function in libavcodec/sanm.c in FFmpeg before 2.7.2 does not properly maintain height and width values in the video context, which allows remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via crafted LucasArts Smush video data.
Exploit likelihood
What each source reports
NVD Score used
The destroy_buffers function in libavcodec/sanm.c in FFmpeg before 2.7.2 does not properly maintain height and width values in the video context, which allows remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via crafted LucasArts Smush video data.
- Record
CVE-2015-6822- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-17
- Updated
- 2026-11-02
CVE List No score
The destroy_buffers function in libavcodec/sanm.c in FFmpeg before 2.7.2 does not properly maintain height and width values in the video context, which allows remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via crafted LucasArts Smush video data.
- Record
CVE-2015-6822- Updated
- 2026-11-02
EUVDEUVD-2015-6759 No score
The destroy_buffers function in libavcodec/sanm.c in FFmpeg before 2.7.2 does not properly maintain height and width values in the video context, which allows remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via crafted LucasArts Smush video data.
- Record
EUVD-2015-6759- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-783g-j5x4-5893 No score
The destroy_buffers function in libavcodec/sanm.c in FFmpeg before 2.7.2 does not properly...
The destroy_buffers function in libavcodec/sanm.c in FFmpeg before 2.7.2 does not properly maintain height and width values in the video context, which allows remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via crafted LucasArts Smush video data.
- Record
GHSA-783g-j5x4-5893- Updated
- 2026-11-02
OSV No score
The destroy_buffers function in libavcodec/sanm.c in FFmpeg before 2.7.2 does not properly maintain height and width values in the video context, which allows remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via crafted LucasArts Smush video data.
- Record
CVE-2015-6822- Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-6822 No score
The destroy_buffers function in libavcodec/sanm.c in FFmpeg before 2.7.2 does not properly maintain height and width values in the video context, which allows remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via crafted LucasArts Smush video data.
- Record
DEBIAN-CVE-2015-6822- Updated
- 2026-11-02
OSVMGASA-2016-0018 No score
Updated ffmpeg packages fix security vulnerabilities
The update_dimensions function in libavcodec/vp8.c in FFmpeg before 2.4.12, as used in Google Chrome before 46.0.2490.71 and other products, relies on a coefficient-partition count during multi-threaded operation, which allows remote attackers to cause a denial of service (race condition and memory corruption) or possibly have unspecified other impact via a crafted WebM file (CVE-2015-6761).
The decode_ihdr_chunk function in libavcodec/pngdec.c in FFmpeg before 2.4.11 does not enforce uniqueness of the IHDR (aka image header) chunk in a PNG image, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted image with two or more of these chunks (CVE-2015-6818).
The ff_sbr_apply function in libavcodec/aacsbr.c in FFmpeg before 2.4.11 does not check for a matching AAC frame syntax element before proceeding with Spectral Band Replication calculations, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted AAC data (CVE-2015-6820).
The ff_mpv_common_init function in libavcodec/mpegvideo.c in FFmpeg before 2.4.11 does not properly maintain the encoding context, which allows remote attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via crafted MPEG data (CVE-2015-6821).
The destroy_buffers function in libavcodec/sanm.c in FFmpeg before 2.4.11 does not properly maintain height and width values in the video context, which allows remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via crafted LucasArts Smush video data (CVE-2015-6822).
The allocate_buffers function in libavcodec/alac.c in FFmpeg before 2.4.11 does not initialize certain context data, which allows remote attackers to cause a denial of service (segmentation violation) or possibly have unspecified other impact via crafted Apple Lossless Audio Codec (ALAC) data (CVE-2015-6823).
The sws_init_context function in libswscale/utils.c in FFmpeg before 2.4.11 does not initialize certain pixbuf data structures, which allows remote attackers to cause a denial of service (segmentation violation) or possibly have unspecified other impact via crafted video data (CVE-2015-6824).
The ff_frame_thread_init function in libavcodec/pthread_frame.c in FFmpeg before 2.4.11 mishandles certain memory-allocation failures, which allows remote attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via a crafted file, as demonstrated by an AVI file (CVE-2015-6825).
The ff_rv34_decode_init_thread_copy function in libavcodec/rv34.c in FFmpeg before 2.4.11 does not initialize certain structure members, which allows remote attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via crafted RV30 or RV40 RealVideo data (CVE-2015-6826).
The ljpeg_decode_yuv_scan function in libavcodec/mjpegdec.c in FFmpeg before 2.4.12 omits certain width and height checks, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted MJPEG data (CVE-2015-8216).
The init_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.4.12 does not enforce minimum-value and maximum-value constraints on tile coordinates, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG 2000 data (CVE-2015-8219).
The jpeg2000_read_main_headers function in libavcodec/jpeg2000dec.c in FFmpeg before 2.4.12 does not enforce uniqueness of the SIZ marker in a JPEG 2000 image, which allows remote attackers to cause a denial of service (out-of-bounds heap-memory access) or possibly have unspecified other impact via a crafted image with two or more of these markers…
- Record
MGASA-2016-0018- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-6822 No score
The destroy_buffers function in libavcodec/sanm.c in FFmpeg before 2.7.2 does not properly maintain height and width values in the video context, which allows remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via crafted LucasArts Smush video data.
- Record
UBUNTU-CVE-2015-6822- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ffmpegDebian:12 |
before 7:2.7.2-1 | 7:2.7.2-1 |
ffmpegDebian:13 |
before 7:2.7.2-1 | 7:2.7.2-1 |
ffmpegDebian:14 |
before 7:2.7.2-1 | 7:2.7.2-1 |
libavDebian:8 From an advisory covering 17 CVEs |
before 6:11.12-1~deb8u2, plus listed versions 6:11.11-1~deb8u16:11.12-1~deb8u16:11.3-16:11.3-1+deb8u16:11.3-2 Show 9 moreShow less6:11.3-36:11.4-16:11.4-1~deb8u16:11.4-26:11.4-2+x32.16:11.6-1~deb8u16:11.7-1~deb8u16:11.8-1~deb8u16:11.9-1~deb8u1 |
6:11.12-1~deb8u2 |
libavDebian:8 From an advisory covering 3 CVEs |
before 6:11.12-1~deb8u3, plus listed versions 6:11.11-1~deb8u16:11.12-1~deb8u16:11.12-1~deb8u26:11.3-16:11.3-1+deb8u1 Show 10 moreShow less6:11.3-26:11.3-36:11.4-16:11.4-1~deb8u16:11.4-26:11.4-2+x32.16:11.6-1~deb8u16:11.7-1~deb8u16:11.8-1~deb8u16:11.9-1~deb8u1 |
6:11.12-1~deb8u3 |
ffmpegMageia:5 From an advisory covering 17 CVEs |
before 2.4.12-1.mga5 | 2.4.12-1.mga5 |
ffmpegMageia:5 From an advisory covering 17 CVEs |
before 2.4.12-1.mga5.tainted | 2.4.12-1.mga5.tainted |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-6822 is a high vulnerability (CVSS 7.5) in Ffmpeg, published September 6, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.41%, the 84th percentile. Fixed in ffmpeg 7:2.7.2-1.
References
lists.debian.org/debian-lts-announce/2018/12/msg00009.html
securitytracker.com/id/1033483
git.videolan.org?p=ffmpeg.git%3Ba=commit%3Bh=39bbdebb1ed8eb9c9b0cd6db85afde6ba89d86e4
ffmpeg.org/security.html
nvd.nist.gov/vuln/detail/CVE-2015-6822
Show 9 moreShow less
github.com/advisories/GHSA-783g-j5x4-5893
security-tracker.debian.org/tracker/CVE-2015-6822
advisories.mageia.org/MGASA-2016-0018.html
bugs.mageia.org/show_bug.cgi?id=17257
ubuntu.com/security/CVE-2015-6822
cve.org/CVERecord?id=CVE-2015-6822
Left out here: the rest of 1 source description. The JSON record has them.