CVE-2015-8271
The AMF3CD_AddProp function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to execute...
The AMF3CD_AddProp function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to execute arbitrary code.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The AMF3CD_AddProp function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to execute arbitrary code.
- Record
CVE-2015-8271- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-123
- Updated
- 2026-11-02
CVE List No score
The AMF3CD_AddProp function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to execute arbitrary code.
- Record
CVE-2015-8271- Updated
- 2026-11-02
EUVDEUVD-2015-8159 No score
The AMF3CD_AddProp function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to execute arbitrary code.
- Record
EUVD-2015-8159- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pfv7-grcx-8gcc
The AMF3CD_AddProp function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to execute...
The AMF3CD_AddProp function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to execute arbitrary code.
- Record
GHSA-pfv7-grcx-8gcc- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-123
- Updated
- 2026-11-02
OSV
The AMF3CD_AddProp function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to execute arbitrary code.
- Record
CVE-2015-8271- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-8271
The AMF3CD_AddProp function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to execute arbitrary code.
- Record
DEBIAN-CVE-2015-8271- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-8271
The AMF3CD_AddProp function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to execute arbitrary code.
- Record
UBUNTU-CVE-2015-8271- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUSN-3283-1 No score
rtmpdump vulnerabilities
Dave McDaniel discovered that rtmpdump incorrectly handled certain malformed streams. If a user were tricked into processing a specially crafted stream, a remote attacker could cause rtmpdump to crash, resulting in a denial of service, or possibly execute arbitrary code.
- Record
USN-3283-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rtmpdumpDebian:12 |
before 2.4+20151223.gitfa8646d.1-1 | 2.4+20151223.gitfa8646d.1-1 |
rtmpdumpDebian:13 |
before 2.4+20151223.gitfa8646d.1-1 | 2.4+20151223.gitfa8646d.1-1 |
rtmpdumpDebian:14 |
before 2.4+20151223.gitfa8646d.1-1 | 2.4+20151223.gitfa8646d.1-1 |
rtmpdumpDebian:7 From an advisory covering 3 CVEs |
before 2.4+20111222.git4e06e21-1+deb7u1, plus listed versions 2.4+20111222.git4e06e21-1 |
2.4+20111222.git4e06e21-1+deb7u1 |
rtmpdumpDebian:8 From an advisory covering 3 CVEs |
before 2.4+20150115.gita107cef-1+deb8u1, plus listed versions 2.4+20150115.gita107cef-1 |
2.4+20150115.gita107cef-1+deb8u1 |
rtmpdumpUbuntu:14.04:LTS |
before 2.4+20121230.gitdf6c518-1ubuntu0.1, plus listed versions 2.4+20121230.gitdf6c518-1 |
2.4+20121230.gitdf6c518-1ubuntu0.1 |
rtmpdumpUbuntu:16.04:LTS |
before 2.4+20151223.gitfa8646d-1ubuntu0.1, plus listed versions 2.4+20150115.gita107cef-1build12.4+20151223.gitfa8646d-12.4+20151223.gitfa8646d-1build1 |
2.4+20151223.gitfa8646d-1ubuntu0.1 |
rtmpdumpUbuntu:14.04:LTS From an advisory covering 3 CVEs |
before 2.4+20121230.gitdf6c518-1ubuntu0.1, plus listed versions 2.4+20121230.gitdf6c518-1 |
2.4+20121230.gitdf6c518-1ubuntu0.1 |
rtmpdumpUbuntu:16.04:LTS From an advisory covering 3 CVEs |
before 2.4+20151223.gitfa8646d-1ubuntu0.1, plus listed versions 2.4+20150115.gita107cef-1build12.4+20151223.gitfa8646d-12.4+20151223.gitfa8646d-1build1 |
2.4+20151223.gitfa8646d-1ubuntu0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-8271 is a critical vulnerability (CVSS 9.8) in Rtmpdump Project Rtmpdump, published April 13, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.92%, the 93rd percentile. Fixed in rtmpdump 2.4+20151223.gitfa8646d.1-1.