{"id":"CVE-2020-15395","aliases":["DEBIAN-CVE-2020-15395","DLA-2603-1","EUVD-2020-7389","GHSA-2g45-mrfv-r6f4","MGASA-2021-0134","UBUNTU-CVE-2020-15395","USN-5237-1"],"status":"published","title":"In MediaInfoLib in MediaArea MediaInfo 20.03, there is a stack-based buffer over-read in...","description":"In MediaInfoLib in MediaArea MediaInfo 20.03, there is a stack-based buffer over-read in Streams_Fill_PerStream in Multiple/File_MpegPs.cpp (aka an off-by-one during MpegPs parsing).","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.01083,"percentile":0.65664,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2020-06-30T10:25:46Z","modified":"2026-10-26T12:00:24Z","fixes":[{"ecosystem":"Debian:12","package":"libmediainfo","fixed_in":["20.09+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libmediainfo","fixed_in":["20.09+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libmediainfo","fixed_in":["20.09+dfsg-1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"libmediainfo","fixed_in":["20.09-1.mga7"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"mediainfo","fixed_in":["20.09-1.mga7"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libmediainfo","fixed_in":["17.12-1ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libmediainfo","fixed_in":["19.09+dfsg-2ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libmediainfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.09+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libmediainfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.09+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libmediainfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.09+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"libmediainfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.91-1+deb9u1"}]}],"versions":["0.7.91-1"],"bundled":4},{"source":"osv","ecosystem":"Mageia:7","package":"libmediainfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.09-1.mga7"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"mediainfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.09-1.mga7"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libmediainfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.12-1ubuntu0.1+esm1"}]}],"versions":["0.7.98-2","0.7.99-1","17.10-1","17.12-1","17.12-1build1","17.12-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libmediainfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.09+dfsg-2ubuntu0.1~esm1"}]}],"versions":["18.12-2","19.09+dfsg-1","19.09+dfsg-2","19.09+dfsg-2build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libmediainfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.67-2ubuntu1+esm2"}]}],"versions":["0.7.64-2","0.7.64-3","0.7.65-1","0.7.67-1","0.7.67-2","0.7.67-2ubuntu1","0.7.67-2ubuntu1+esm1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libmediainfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.82-1ubuntu0.1~esm2"}]}],"versions":["0.7.73-1ubuntu1","0.7.80-1","0.7.81-1","0.7.82-1","0.7.82-1ubuntu0.1~esm1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libmediainfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.12-1ubuntu0.1+esm1"}]}],"versions":["0.7.98-2","0.7.99-1","17.10-1","17.12-1","17.12-1build1","17.12-1ubuntu0.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libmediainfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.09+dfsg-2ubuntu0.1~esm1"}]}],"versions":["18.12-2","19.09+dfsg-1","19.09+dfsg-2","19.09+dfsg-2build1"],"bundled":2}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"mediaarea","product":"mediainfo"}],"references":[{"url":"https://sourceforge.net/p/mediainfo/bugs/1127/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://mediaarea.net/en/MediaInfo","tags":["x_refsource_MISC","x_transferred","Product","Vendor Advisory","advisory","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QQJCEQRRPTN5CY5URDFTEJU3A2VKLNBA/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15395"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QQJCEQRRPTN5CY5URDFTEJU3A2VKLNBA/"},{"url":"https://github.com/advisories/GHSA-2g45-mrfv-r6f4"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-15395","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0134.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=27626","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/QQJCEQRRPTN5CY5URDFTEJU3A2VKLNBA/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/KSR47ROV33MCI6NPBVCSG5WTU5L4YGIY/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-15395","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5237-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15395","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-26797","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-15395","description":"In MediaInfoLib in MediaArea MediaInfo 20.03, there is a stack-based buffer over-read in Streams_Fill_PerStream in Multiple/File_MpegPs.cpp (aka an off-by-one during MpegPs parsing).","status":"published","published":"2020-06-30T10:25:46Z","modified":"2024-08-04T13:15:20.528Z","updated_at":"2026-11-02T14:35:49.879248Z"}],"euvd":[{"id":"EUVD-2020-7389","description":"In MediaInfoLib in MediaArea MediaInfo 20.03, there is a stack-based buffer over-read in Streams_Fill_PerStream in Multiple/File_MpegPs.cpp (aka an off-by-one during MpegPs parsing).","status":"published","published":"2020-06-30T10:25:46Z","modified":"2024-08-04T13:15:20Z","updated_at":"2026-11-03T03:07:31.508652Z"}],"ghsa":[{"id":"GHSA-2g45-mrfv-r6f4","title":"In MediaInfoLib in MediaArea MediaInfo 20.03, there is a stack-based buffer over-read in...","description":"In MediaInfoLib in MediaArea MediaInfo 20.03, there is a stack-based buffer over-read in Streams_Fill_PerStream in Multiple/File_MpegPs.cpp (aka an off-by-one during MpegPs parsing).","status":"published","published":"2022-05-24T17:22:07Z","modified":"2023-01-28T05:02:44Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:43:50.187003Z"}],"nvd":[{"id":"CVE-2020-15395","description":"In MediaInfoLib in MediaArea MediaInfo 20.03, there is a stack-based buffer over-read in Streams_Fill_PerStream in Multiple/File_MpegPs.cpp (aka an off-by-one during MpegPs parsing).","status":"published","published":"2020-06-30T11:15:10.52Z","modified":"2026-06-17T02:56:37.257Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:06:08.145904Z"}],"osv":[{"id":"CVE-2020-15395","description":"In MediaInfoLib in MediaArea MediaInfo 20.03, there is a stack-based buffer over-read in Streams_Fill_PerStream in Multiple/File_MpegPs.cpp (aka an off-by-one during MpegPs parsing).","status":"published","published":"2020-06-30T11:15:10.52Z","modified":"2026-10-24T10:30:28.077531214Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:14.828228Z"},{"id":"DEBIAN-CVE-2020-15395","description":"In MediaInfoLib in MediaArea MediaInfo 20.03, there is a stack-based buffer over-read in Streams_Fill_PerStream in Multiple/File_MpegPs.cpp (aka an off-by-one during MpegPs parsing).","status":"published","published":"2020-06-30T11:15:10.52Z","modified":"2026-10-26T12:00:24.871003107Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:33.384087Z"},{"id":"UBUNTU-CVE-2020-15395","description":"In MediaInfoLib in MediaArea MediaInfo 20.03, there is a stack-based buffer over-read in Streams_Fill_PerStream in Multiple/File_MpegPs.cpp (aka an off-by-one during MpegPs parsing).","status":"published","published":"2020-06-30T11:15:00Z","modified":"2026-04-22T12:19:34.493431Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:23.344108Z"},{"id":"DLA-2603-1","title":"libmediainfo - security update","status":"published","published":"2021-03-22T00:00:00Z","modified":"2026-03-09T01:20:03.395123Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"MGASA-2021-0134","title":"Updated mediainfo packages a fix security vulnerability","description":"In MediaInfoLib in MediaArea MediaInfo 20.03, there is a stack-based buffer\nover-read in Streams_Fill_PerStream in Multiple/File_MpegPs.cpp (aka an\noff-by-one during MpegPs parsing) (CVE-2020-15395).\n","status":"published","published":"2021-03-14T21:20:42Z","modified":"2026-04-16T04:40:53.471415173Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"USN-5237-1","title":"libmediainfo vulnerabilities","description":"It was discovered that MediaInfoLib incorrectly handled certain specially\ncrafted files. An attacker could possibly use this issue to cause a denial\nof service. (CVE-2020-26797)\n\nIt was discovered that MediaInfoLib incorrectly handled certain specially\ncrafted MpegPs files. An attacker could possibly use this issue to cause a\ndenial of service. This issue only affected Ubuntu 18.04 ESM and Ubuntu 20.04\nESM. (CVE-2020-15395)\n","status":"published","published":"2022-08-01T05:54:27Z","modified":"2026-06-29T13:49:35.385357816Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}