CVE-2015-6761

NameCVE-2015-6761
DescriptionThe update_dimensions function in libavcodec/vp8.c in FFmpeg through 2.8.1, as used in Google Chrome before 46.0.2490.71 and other products, relies on a coefficient-partition count during multi-threaded operation, which allows remote attackers to cause a denial of service (race condition and memory corruption) or possibly have unspecified other impact via a crafted WebM file.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-3376-1
NVD severitymedium (attack range: remote)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
chromium-browser (PTS)wheezy, wheezy (security)37.0.2062.120-1~deb7u1vulnerable
jessie (security), jessie57.0.2987.98-1~deb8u1fixed
stretch (security), stretch61.0.3163.100-1~deb9u1fixed
buster, sid61.0.3163.100-2fixed
ffmpeg (PTS)stretch7:3.2.7-1~deb9u1fixed
stretch (security)7:3.2.8-1~deb9u1fixed
buster, sid7:3.3.4-2fixed
libav (PTS)wheezy6:0.8.17-2fixed
wheezy (security)6:0.8.21-0+deb7u1fixed
jessie (security), jessie6:11.9-1~deb8u1undetermined

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
chromium-browsersource(unstable)44.0.2403.157-1medium
chromium-browsersourcejessie46.0.2490.71-1~deb8u1mediumDSA-3376-1
chromium-browsersourcesqueeze(unfixed)end-of-life
chromium-browsersourcewheezy(unfixed)end-of-life
ffmpegsource(unstable)7:2.8.1-1medium
ffmpegsourcesqueeze(unfixed)end-of-life
libavsource(unstable)undeterminedmedium
libavsourcewheezy(not affected)

Notes

[squeeze] - ffmpeg <end-of-life> (Not supported in Squeeze LTS)
[wheezy] - libav <not-affected> (Vulnerable code not present)
https://code.google.com/p/chromium/issues/detail?id=447860
https://code.google.com/p/chromium/issues/detail?id=532967
Starting with 44.0.2403.157-1 chromium uses the ffmpeg system copy
It looks like this relates to multithreaded decoding of VPx codecs, which is not implemented in the squeeze version. But I'm not sure as the second bug report is still private.

Search for package or bug name: Reporting problems