PublicDateAtUSN: 2015-06-16
Candidate: CVE-2015-3395
PublicDate: 2015-06-16 16:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3395
 http://ffmpeg.org/security.html
 https://ubuntu.com/security/notices/USN-2944-1
Description:
 The msrle_decode_pal4 function in msrledec.c in Libav before 10.7 and 11.x
 before 11.4 and FFmpeg before 2.0.7, 2.2.x before 2.2.15, 2.4.x before
 2.4.8, 2.5.x before 2.5.6, and 2.6.x before 2.6.2 allows remote attackers
 to have unspecified impact via a crafted image, related to a pixel pointer,
 which triggers an out-of-bounds array access.
Ubuntu-Description:
 It was discovered that Libav incorrectly handled certain media
 files. An attacker could possibly use this issue to cause a denial of
 service or other unspecified impact.
Notes:
Bugs:
Priority: low
Discovered-by:
Assigned-to:
CVSS: 

Patches_chromium-browser:
upstream_chromium-browser: released
precise_chromium-browser: ignored
precise/esm_chromium-browser: DNE (precise was ignored)
trusty_chromium-browser: released (47.0.2526.73-0ubuntu0.14.04.1.1106)
trusty/esm_chromium-browser: DNE (trusty was released [47.0.2526.73-0ubuntu0.14.04.1.1106])
utopic_chromium-browser: ignored (reached end-of-life)
vivid_chromium-browser: released (47.0.2526.73-0ubuntu0.15.04.1.1190)
vivid/stable-phone-overlay_chromium-browser: DNE
vivid/ubuntu-core_chromium-browser: DNE
wily_chromium-browser: released (47.0.2526.73-0ubuntu0.15.10.1.1215)
xenial_chromium-browser: released (47.0.2526.73-0ubuntu1.1218)
yakkety_chromium-browser: released (47.0.2526.73-0ubuntu1.1218)
zesty_chromium-browser: released (47.0.2526.73-0ubuntu1.1218)
artful_chromium-browser: released (47.0.2526.73-0ubuntu1.1218)
bionic_chromium-browser: released (47.0.2526.73-0ubuntu1.1218)
cosmic_chromium-browser: released (47.0.2526.73-0ubuntu1.1218)
disco_chromium-browser: released (47.0.2526.73-0ubuntu1.1218)
devel_chromium-browser: released (47.0.2526.73-0ubuntu1.1218)

Patches_oxide-qt:
upstream_oxide-qt: not-affected (1.19.4)
precise_oxide-qt: DNE
precise/esm_oxide-qt: DNE
trusty_oxide-qt: not-affected (1.19.4-0ubuntu0.14.04.1)
trusty/esm_oxide-qt: DNE (trusty was not-affected [1.19.4-0ubuntu0.14.04.1])
utopic_oxide-qt: ignored (reached end-of-life)
vivid_oxide-qt: ignored (reached end-of-life)
vivid/stable-phone-overlay_oxide-qt: not-affected (1.17.9-0ubuntu0.15.04.1~overlay2)
vivid/ubuntu-core_oxide-qt: DNE
wily_oxide-qt: ignored (reached end-of-life)
xenial_oxide-qt: not-affected (1.19.4-0ubuntu0.16.04.1)
esm-infra/xenial_oxide-qt: not-affected (1.19.4-0ubuntu0.16.04.1)
yakkety_oxide-qt: not-affected (1.19.4-0ubuntu0.16.10.1)
zesty_oxide-qt: not-affected (1.17.9-0ubuntu1)
artful_oxide-qt: not-affected (1.17.9-0ubuntu1)
bionic_oxide-qt: DNE
cosmic_oxide-qt: DNE
disco_oxide-qt: DNE
devel_oxide-qt: DNE

Patches_libav:
 upstream: https://git.libav.org/?p=libav.git;a=commit;h=5ecabd3c54b7c802522dc338838c9a4c2dc42948
upstream_libav: released (11.4)
precise_libav: released (4:0.8.17-0ubuntu0.12.04.2)
precise/esm_libav: DNE (precise was released [4:0.8.17-0ubuntu0.12.04.2])
trusty_libav: ignored (reached end-of-life)
trusty/esm_libav: DNE (trusty was needed)

utopic_libav: ignored (reached end-of-life)
vivid_libav: ignored (reached end-of-life)
vivid/stable-phone-overlay_libav: DNE
vivid/ubuntu-core_libav: DNE
wily_libav: DNE
xenial_libav: DNE
yakkety_libav: DNE
zesty_libav: DNE
artful_libav: DNE
bionic_libav: DNE
cosmic_libav: DNE
disco_libav: DNE
devel_libav: DNE

Patches_ffmpeg:
 upstream: https://github.com/FFmpeg/FFmpeg/commit/dfce316c12d867400fb132ff5094163e3d2634a3
 upstream: https://github.com/FFmpeg/FFmpeg/commit/f7e1367f58263593e6cee3c282f7277d7ee9d553
upstream_ffmpeg: released (2.5.6,2.6.2)
precise_ffmpeg: DNE
precise/esm_ffmpeg: DNE
trusty_ffmpeg: DNE
trusty/esm_ffmpeg: DNE
utopic_ffmpeg: DNE
vivid_ffmpeg: released (7:2.5.6-0ubuntu0.15.04.1)
vivid/stable-phone-overlay_ffmpeg: DNE
vivid/ubuntu-core_ffmpeg: DNE
wily_ffmpeg: not-affected (7:2.7.3-0ubuntu0.15.10.1)
xenial_ffmpeg: not-affected (7:2.8.3-1)
yakkety_ffmpeg: not-affected (7:2.8.3-1)
zesty_ffmpeg: not-affected (7:2.8.3-1)
artful_ffmpeg: not-affected (7:2.8.3-1)
bionic_ffmpeg: not-affected (7:2.8.3-1)
cosmic_ffmpeg: not-affected (7:2.8.3-1)
disco_ffmpeg: not-affected (7:2.8.3-1)
devel_ffmpeg: not-affected (7:2.8.3-1)