Every CVE Search/ Get API key

CVE-2015-6360

The encryption-processing feature in Cisco libSRTP before 1.5.3 allows remote attackers to cause...

7.5 HighFix available

The encryption-processing feature in Cisco libSRTP before 1.5.3 allows remote attackers to cause a denial of service via crafted fields in SRTP packets, aka Bug ID CSCux00686.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

8.28%Up 6.3 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

The encryption-processing feature in Cisco libSRTP before 1.5.3 allows remote attackers to cause a denial of service via crafted fields in SRTP packets, aka Bug ID CSCux00686.

Record
CVE-2015-6360
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
7.8 HighAV:N/AC:L/Au:N/C:N/I:N/A:C
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

The encryption-processing feature in Cisco libSRTP before 1.5.3 allows remote attackers to cause a denial of service via crafted fields in SRTP packets, aka Bug ID CSCux00686.

Record
CVE-2015-6360
Updated
2026-11-02
EUVDEUVD-2015-6302 No score

The encryption-processing feature in Cisco libSRTP before 1.5.3 allows remote attackers to cause a denial of service via crafted fields in SRTP packets, aka Bug ID CSCux00686.

Record
EUVD-2015-6302
Updated
2026-11-03
GitHub AdvisoriesGHSA-5m3h-4mfw-792p 7.5

The encryption-processing feature in Cisco libSRTP before 1.5.3 allows remote attackers to cause...

The encryption-processing feature in Cisco libSRTP before 1.5.3 allows remote attackers to cause a denial of service via crafted fields in SRTP packets, aka Bug ID CSCux00686.

Record
GHSA-5m3h-4mfw-792p
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-119
Updated
2026-11-02
OSVMGASA-2016-0037 No score

Updated srtp packages fix security vulnerability

Srtp before 1.5.3 is vulnerable to a potential DoS attack due to lack of bounds checking on RTP header CSRC count and extension header length (CVE-2015-6360).

Record
MGASA-2016-0037
Updated
2026-11-02
OSVopenSUSE-SU-2024:10265-1 No score

libsrtp-devel-1.5.4-2.1 on GA media

These are all security issues fixed in the libsrtp-devel-1.5.4-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10265-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10997-1 No score

libsrtp2-1-2.4.1-1.2 on GA media

These are all security issues fixed in the libsrtp2-1-2.4.1-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10997-1
Updated
2026-11-02

Affected products

Show 2 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
srtp
Debian:6.0
 before 1.4.4~dfsg-6+deb6u2, plus listed versions
1.4.4~dfsg-6
1.4.4~dfsg-6+deb6u2
srtp
Debian:7
 before 1.4.4+20100615~dfsg-2+deb7u2, plus listed versions
1.4.4+20100615~dfsg-21.4.4+20100615~dfsg-2+deb7u1
1.4.4+20100615~dfsg-2+deb7u2
srtp
Debian:8
 before 1.4.5~20130609~dfsg-1.1+deb8u1, plus listed versions
1.4.5~20130609~dfsg-1.1
1.4.5~20130609~dfsg-1.1+deb8u1
srtp
Mageia:5
 before 1.4.5-0.20130723.5.mga5
1.4.5-0.20130723.5.mga5
libsrtp
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
 before 0:1.4.4-11.20101004cvs.el7
0:1.4.4-11.20101004cvs.el7
libsrtp-debuginfo
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
 before 0:1.4.4-11.20101004cvs.el7
0:1.4.4-11.20101004cvs.el7
libsrtp-devel
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
 before 0:1.4.4-11.20101004cvs.el7
0:1.4.4-11.20101004cvs.el7
libsrtp
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
 before 0:1.4.4-11.20101004cvs.el7
0:1.4.4-11.20101004cvs.el7
libsrtp-debuginfo
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
 before 0:1.4.4-11.20101004cvs.el7
0:1.4.4-11.20101004cvs.el7
libsrtp-devel
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
 before 0:1.4.4-11.20101004cvs.el7
0:1.4.4-11.20101004cvs.el7
Show 8 moreShow less
Affected packages
PackageAffectedFixed
libsrtp
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
 before 0:1.4.4-11.20101004cvs.el7
0:1.4.4-11.20101004cvs.el7
libsrtp-debuginfo
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
 before 0:1.4.4-11.20101004cvs.el7
0:1.4.4-11.20101004cvs.el7
libsrtp-devel
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
 before 0:1.4.4-11.20101004cvs.el7
0:1.4.4-11.20101004cvs.el7
libsrtp
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
 before 0:1.4.4-11.20101004cvs.el7
0:1.4.4-11.20101004cvs.el7
libsrtp-debuginfo
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
 before 0:1.4.4-11.20101004cvs.el7
0:1.4.4-11.20101004cvs.el7
libsrtp-devel
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
 before 0:1.4.4-11.20101004cvs.el7
0:1.4.4-11.20101004cvs.el7
libsrtp
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 1.5.4-2.1
1.5.4-2.1
libsrtp
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 2.4.1-1.2
2.4.1-1.2

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-6360 is a high vulnerability (CVSS 7.5) in Cisco Libsrtp, published January 17, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.28%, the 94th percentile. Fixed in srtp 1.4.4~dfsg-6+deb6u2.

References

Show 23 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open