CVE-2015-8270
The AMF3ReadString function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to cause a...
The AMF3ReadString function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to cause a denial of service (invalid pointer dereference and process crash).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The AMF3ReadString function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to cause a denial of service (invalid pointer dereference and process crash).
- Record
CVE-2015-8270- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-476
- Updated
- 2026-11-02
CVE List No score
The AMF3ReadString function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to cause a denial of service (invalid pointer dereference and process crash).
- Record
CVE-2015-8270- Updated
- 2026-11-02
EUVDEUVD-2015-8158 No score
The AMF3ReadString function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to cause a denial of service (invalid pointer dereference and process crash).
- Record
EUVD-2015-8158- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hg4c-2mw4-gwpm
The AMF3ReadString function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to cause a...
The AMF3ReadString function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to cause a denial of service (invalid pointer dereference and process crash).
- Record
GHSA-hg4c-2mw4-gwpm- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
OSV
The AMF3ReadString function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to cause a denial of service (invalid pointer dereference and process crash).
- Record
CVE-2015-8270- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-8270
The AMF3ReadString function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to cause a denial of service (invalid pointer dereference and process crash).
- Record
DEBIAN-CVE-2015-8270- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-8270
The AMF3ReadString function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to cause a denial of service (invalid pointer dereference and process crash).
- Record
UBUNTU-CVE-2015-8270- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUSN-3283-1 No score
rtmpdump vulnerabilities
Dave McDaniel discovered that rtmpdump incorrectly handled certain malformed streams. If a user were tricked into processing a specially crafted stream, a remote attacker could cause rtmpdump to crash, resulting in a denial of service, or possibly execute arbitrary code.
- Record
USN-3283-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rtmpdumpDebian:12 |
before 2.4+20151223.gitfa8646d.1-1 | 2.4+20151223.gitfa8646d.1-1 |
rtmpdumpDebian:13 |
before 2.4+20151223.gitfa8646d.1-1 | 2.4+20151223.gitfa8646d.1-1 |
rtmpdumpDebian:14 |
before 2.4+20151223.gitfa8646d.1-1 | 2.4+20151223.gitfa8646d.1-1 |
rtmpdumpDebian:7 From an advisory covering 3 CVEs |
before 2.4+20111222.git4e06e21-1+deb7u1, plus listed versions 2.4+20111222.git4e06e21-1 |
2.4+20111222.git4e06e21-1+deb7u1 |
rtmpdumpDebian:8 From an advisory covering 3 CVEs |
before 2.4+20150115.gita107cef-1+deb8u1, plus listed versions 2.4+20150115.gita107cef-1 |
2.4+20150115.gita107cef-1+deb8u1 |
rtmpdumpUbuntu:14.04:LTS |
before 2.4+20121230.gitdf6c518-1ubuntu0.1, plus listed versions 2.4+20121230.gitdf6c518-1 |
2.4+20121230.gitdf6c518-1ubuntu0.1 |
rtmpdumpUbuntu:16.04:LTS |
before 2.4+20151223.gitfa8646d-1ubuntu0.1, plus listed versions 2.4+20150115.gita107cef-1build12.4+20151223.gitfa8646d-12.4+20151223.gitfa8646d-1build1 |
2.4+20151223.gitfa8646d-1ubuntu0.1 |
rtmpdumpUbuntu:14.04:LTS From an advisory covering 3 CVEs |
before 2.4+20121230.gitdf6c518-1ubuntu0.1, plus listed versions 2.4+20121230.gitdf6c518-1 |
2.4+20121230.gitdf6c518-1ubuntu0.1 |
rtmpdumpUbuntu:16.04:LTS From an advisory covering 3 CVEs |
before 2.4+20151223.gitfa8646d-1ubuntu0.1, plus listed versions 2.4+20150115.gita107cef-1build12.4+20151223.gitfa8646d-12.4+20151223.gitfa8646d-1build1 |
2.4+20151223.gitfa8646d-1ubuntu0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-8270 is a high vulnerability (CVSS 7.5) in Rtmpdump Project Rtmpdump, published April 13, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.16%, the 88th percentile. Fixed in rtmpdump 2.4+20151223.gitfa8646d.1-1.