{"id":"CVE-2015-3395","aliases":["DEBIAN-CVE-2015-3395","DSA-3288-1","EUVD-2015-3440","GHSA-h626-6f8j-9rc9","MGASA-2015-0245","UBUNTU-CVE-2015-3395","openSUSE-SU-2024:10926-1"],"status":"published","title":"The msrle_decode_pal4 function in msrledec.c in Libav before 10.7 and 11.x before 11.4 and FFmpeg...","description":"The msrle_decode_pal4 function in msrledec.c in Libav before 10.7 and 11.x before 11.4 and FFmpeg before 2.0.7, 2.2.x before 2.2.15, 2.4.x before 2.4.8, 2.5.x before 2.5.6, and 2.6.x before 2.6.2 allows remote attackers to have unspecified impact via a crafted image, related to a pixel pointer, which triggers an out-of-bounds array access.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02376,"percentile":0.83961,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2015-06-13T00:00:00Z","modified":"2026-09-09T06:47:30Z","fixes":[{"ecosystem":"Debian:12","package":"ffmpeg","fixed_in":["7:2.6.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ffmpeg","fixed_in":["7:2.6.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ffmpeg","fixed_in":["7:2.6.2-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"chromium-browser","fixed_in":["47.0.2526.73-0ubuntu0.14.04.1.1106"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libav","fixed_in":["6:9.20-0ubuntu0.14.04.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"chromium-browser","fixed_in":["47.0.2526.73-0ubuntu1.1218"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:2.6.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:2.6.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:2.6.2-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"libav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6:11.4-1~deb8u1"}]}],"versions":["6:11.3-1","6:11.3-1+deb8u1","6:11.3-2","6:11.3-3"],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-1.mga4"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:4","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-1.mga4.tainted"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"chromium-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"47.0.2526.73-0ubuntu0.14.04.1.1106"}]}],"versions":["29.0.1547.65-0ubuntu2","31.0.1650.63-0ubuntu1~20131204.1","32.0.1700.107-0ubuntu1~20140204.977.1","33.0.1750.152-0ubuntu1~pkg995.1","34.0.1847.116-0ubuntu2","36.0.1985.125-0ubuntu1.14.04.0~pkg1029","37.0.2062.94-0ubuntu0.14.04.1~pkg1042","37.0.2062.120-0ubuntu0.14.04.1~pkg1049","38.0.2125.111-0ubuntu0.14.04.1.1061","39.0.2171.65-0ubuntu0.14.04.1.1064","40.0.2214.94-0ubuntu0.14.04.1.1068","40.0.2214.111-0ubuntu0.14.04.1.1069","41.0.2272.76-0ubuntu0.14.04.1.1076","43.0.2357.81-0ubuntu0.14.04.1.1089","43.0.2357.130-0ubuntu0.14.04.1.1092","44.0.2403.89-0ubuntu0.14.04.1.1095","45.0.2454.85-0ubuntu0.14.04.1.1097","45.0.2454.101-0ubuntu0.14.04.1.1099"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6:9.20-0ubuntu0.14.04.1+esm1"}]}],"versions":["6:0.8.7-1ubuntu2","6:9.10-1ubuntu1","6:9.10-1ubuntu2","6:9.10-1ubuntu5","6:9.10-1ubuntu6","6:9.10-1ubuntu7","6:9.11-2ubuntu1","6:9.11-2ubuntu2","6:9.13-0ubuntu0.14.04.1","6:9.14-0ubuntu0.14.04.1","6:9.16-0ubuntu0.14.04.1","6:9.18-0ubuntu0.14.04.1","6:9.20-0ubuntu0.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"chromium-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"47.0.2526.73-0ubuntu1.1218"}]}],"versions":["45.0.2454.101-0ubuntu1.1201"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libav-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.3-1.17"}]}],"bundled":12}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"ffmpeg","product":"ffmpeg"},{"vendor":"libav","product":"libav"}],"references":[{"url":"https://git.libav.org/?p=libav.git%3Ba=blob%3Bf=Changelog%3Bhb=refs/tags/v11.4","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/201705-08","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2944-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.debian.org/security/2015/dsa-3288","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=f7e1367f58263593e6cee3c282f7277d7ee9d553","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/201603-06","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/74433","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://www.ffmpeg.org/security.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3395"},{"url":"https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.4"},{"url":"http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=f7e1367f58263593e6cee3c282f7277d7ee9d553"},{"url":"https://github.com/advisories/GHSA-h626-6f8j-9rc9"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-3395","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0245.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15502","tags":["report"]},{"url":"http://vigilance.fr/vulnerability/FFmpeg-unreachable-memory-reading-via-mjpegdec-c-16213","tags":["web"]},{"url":"http://git.videolan.org/?p=ffmpeg.git;a=log;h=n2.0.7","tags":["web"]},{"url":"http://ffmpeg.org/olddownload.html","tags":["web"]},{"url":"http://ffmpeg.org/security.html","tags":["web","report"]},{"url":"https://ubuntu.com/security/CVE-2015-3395","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2944-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3395","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-6618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-7010","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8544","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9604","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3395","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3417","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3062","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-3395","description":"The msrle_decode_pal4 function in msrledec.c in Libav before 10.7 and 11.x before 11.4 and FFmpeg before 2.0.7, 2.2.x before 2.2.15, 2.4.x before 2.4.8, 2.5.x before 2.5.6, and 2.6.x before 2.6.2 allows remote attackers to have unspecified impact via a crafted image, related to a pixel pointer, which triggers an out-of-bounds array access.","status":"published","published":"2015-06-16T16:00:00Z","modified":"2024-08-06T05:47:57.389Z","updated_at":"2026-11-02T14:35:42.331636Z"}],"euvd":[{"id":"EUVD-2015-3440","description":"The msrle_decode_pal4 function in msrledec.c in Libav before 10.7 and 11.x before 11.4 and FFmpeg before 2.0.7, 2.2.x before 2.2.15, 2.4.x before 2.4.8, 2.5.x before 2.5.6, and 2.6.x before 2.6.2 allows remote attackers to have unspecified impact via a crafted image, related to a pixel pointer, which triggers an out-of-bounds array access.","status":"published","published":"2015-06-16T16:00:00Z","modified":"2024-08-06T05:47:57Z","updated_at":"2026-11-03T02:22:08.106657Z"}],"ghsa":[{"id":"GHSA-h626-6f8j-9rc9","title":"The msrle_decode_pal4 function in msrledec.c in Libav before 10.7 and 11.x before 11.4 and FFmpeg...","description":"The msrle_decode_pal4 function in msrledec.c in Libav before 10.7 and 11.x before 11.4 and FFmpeg before 2.0.7, 2.2.x before 2.2.15, 2.4.x before 2.4.8, 2.5.x before 2.5.6, and 2.6.x before 2.6.2 allows remote attackers to have unspecified impact via a crafted image, related to a pixel pointer, which triggers an out-of-bounds array access.","status":"published","published":"2022-05-17T02:38:48Z","modified":"2025-04-12T12:49:58Z","cwes":["CWE-119"],"updated_at":"2026-11-02T15:01:22.814855Z"}],"nvd":[{"id":"CVE-2015-3395","description":"The msrle_decode_pal4 function in msrledec.c in Libav before 10.7 and 11.x before 11.4 and FFmpeg before 2.0.7, 2.2.x before 2.2.15, 2.4.x before 2.4.8, 2.5.x before 2.5.6, and 2.6.x before 2.6.2 allows remote attackers to have unspecified impact via a crafted image, related to a pixel pointer, which triggers an out-of-bounds array access.","status":"published","published":"2015-06-16T16:59:04.237Z","modified":"2026-06-17T00:25:52.09Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:03:05.884985Z"}],"osv":[{"id":"CVE-2015-3395","description":"The msrle_decode_pal4 function in msrledec.c in Libav before 10.7 and 11.x before 11.4 and FFmpeg before 2.0.7, 2.2.x before 2.2.15, 2.4.x before 2.4.8, 2.5.x before 2.5.6, and 2.6.x before 2.6.2 allows remote attackers to have unspecified impact via a crafted image, related to a pixel pointer, which triggers an out-of-bounds array access.","status":"published","published":"2015-06-16T16:59:04Z","modified":"2026-04-16T06:17:16.621122589Z","updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-3395","description":"The msrle_decode_pal4 function in msrledec.c in Libav before 10.7 and 11.x before 11.4 and FFmpeg before 2.0.7, 2.2.x before 2.2.15, 2.4.x before 2.4.8, 2.5.x before 2.5.6, and 2.6.x before 2.6.2 allows remote attackers to have unspecified impact via a crafted image, related to a pixel pointer, which triggers an out-of-bounds array access.","status":"published","published":"2015-06-16T16:59:04.237Z","modified":"2026-09-09T06:47:30.135454786Z","updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"DSA-3288-1","title":"libav - security update","status":"published","published":"2015-06-13T00:00:00Z","modified":"2026-03-09T01:21:47.731311Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2015-0245","title":"Updated ffmpeg package fixes security vulnerability","description":"The mjpeg_decode_app function in libavcodec/mjpegdec.c in FFMpeg before 2.0.7\nallows remote attackers to cause a denial of service (out-of-bounds heap\naccess) and possibly have other unspecified impact via vectors related to\nLJIF tags in an MJPEG file (CVE-2014-9316).\n\nThe decode_ihdr_chunk function in libavcodec/pngdec.c in FFMpeg before 2.0.7\nallows remote attackers to cause a denial of service (out-of-bounds heap\naccess) and possibly have other unspecified impact via an IDAT before an IHDR\nin a PNG file (CVE-2014-9317).\n\nThe raw_decode function in libavcodec/rawdec.c in FFMpeg before 2.0.7 allows\nremote attackers to cause a denial of service (out-of-bounds heap access) and\npossibly have other unspecified impact via a crafted .cine file that triggers\nthe avpicture_get_size function to return a negative frame size\n(CVE-2014-9318).\n\nThe vmd_decode function in libavcodec/vmdvideo.c in FFmpeg before 2.0.7 does\nnot validate the relationship between a certain length value and the frame\nwidth, which allows remote attackers to cause a denial of service\n(out-of-bounds array access) or possibly have unspecified other impact via\ncrafted Sierra VMD video data (CVE-2014-9603).\n\nlibavcodec/utvideodec.c in FFmpeg before 2.0.7 does not check for a zero\nvalue of a slice height, which allows remote attackers to cause a denial of\nservice (out-of-bounds array access) or possibly have unspecified other\nimpact via crafted Ut Video data, related to the restore_median and\nrestore_median_il functions (CVE-2014-9604).\n\nAn attacker can force a read at an invalid address in mjpegdec.c of FFmpeg,\nin order to trigger a denial of service (CVE-2015-1872).\n\nThe msrle_decode_pal4 function in libavcodec/msrledec.c in FFmpeg before\n2.0.7 has an out-of-bounds array access that may allow remote attackers to\ncause a denial of service or possibly have unspecified other impact via a\ncrafted BMP file (CVE-2015-3395).\n\nUse-after-free vulnerability in the ff_h264_free_tables function in\nlibavcodec/h264.c in FFmpeg before 2.0.7 allows remote attackers to cause a\ndenial of service or possibly have unspecified other impact via crafted H.264\ndata in an MP4 file, as demonstrated by an HTML VIDEO element that references\nH.264 data (CVE-2015-3417).\n","status":"published","published":"2015-06-19T13:33:05Z","modified":"2026-04-16T06:23:41.576146854Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"openSUSE-SU-2024:10926-1","title":"libav-tools-12.3-1.17 on GA media","description":"These are all security issues fixed in the libav-tools-12.3-1.17 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:10:03.438996Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"UBUNTU-CVE-2015-3395","description":"The msrle_decode_pal4 function in msrledec.c in Libav before 10.7 and 11.x before 11.4 and FFmpeg before 2.0.7, 2.2.x before 2.2.15, 2.4.x before 2.4.8, 2.5.x before 2.5.6, and 2.6.x before 2.6.2 allows remote attackers to have unspecified impact via a crafted image, related to a pixel pointer, which triggers an out-of-bounds array access.","status":"published","published":"2015-06-16T00:00:00Z","modified":"2026-04-22T09:33:05.054366Z","updated_at":"2026-11-02T15:54:10.045446Z"}]}}