CVE-2015-6761

NameCVE-2015-6761
DescriptionThe update_dimensions function in libavcodec/vp8.c in FFmpeg through 2.8.1, as used in Google Chrome before 46.0.2490.71 and other products, relies on a coefficient-partition count during multi-threaded operation, which allows remote attackers to cause a denial of service (race condition and memory corruption) or possibly have unspecified other impact via a crafted WebM file.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-1611-1, DSA-3376-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
ffmpeg (PTS)bullseye7:4.3.7-0+deb11u1fixed
bullseye (security)7:4.3.8-0+deb11u1fixed
bookworm, bookworm (security)7:5.1.6-0+deb12u1fixed
sid, trixie7:7.1-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
chromium-browsersourcesqueeze(unfixed)end-of-life
chromium-browsersourcewheezy(unfixed)end-of-life
chromium-browsersourcejessie46.0.2490.71-1~deb8u1DSA-3376-1
chromium-browsersource(unstable)44.0.2403.157-1
ffmpegsourcesqueeze(unfixed)end-of-life
ffmpegsource(unstable)7:2.8.1-1
libavsourcewheezy(not affected)
libavsourcejessie6:11.12-1~deb8u2DLA-1611-1
libavsource(unstable)(unfixed)

Notes

[squeeze] - ffmpeg <end-of-life> (Not supported in Squeeze LTS)
[wheezy] - libav <not-affected> (Vulnerable code not present)
https://code.google.com/p/chromium/issues/detail?id=447860
https://code.google.com/p/chromium/issues/detail?id=532967
Starting with 44.0.2403.157-1 chromium uses the ffmpeg system copy
It looks like this relates to multithreaded decoding of VPx codecs, which is not implemented in the squeeze version. But I'm not sure as the second bug report is still private.
https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=dabea74d0e82ea80cd344f630497cafcb3ef872c

Search for package or bug name: Reporting problems