rainbutterfly/cve_corpus huggingface dataset:
CVE-2015-8284 
SeaWell Networks Spectrum SDC 02.05.00 allows remote viewer users to perform administrative functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-13T14:00:00.000Z
CVE-2015-8285 
The webssx.sys driver in QuickHeal 16.00 allows remote attackers to cause a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-20T21:00:00.000Z
CVE-2015-8286 
Zhuhai RaySharp firmware has a hardcoded root password, which makes it easier for remote attackers to obtain access via a session on TCP port 23 or 9000.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-02-18T02:00:00.000Z
CVE-2015-8287 
Swann SRNVW-470LCD devices with firmware through 0114 and SWNVW-470CAM devices with firmware through 1022 allow remote attackers to watch live video by visiting an unspecified URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-02-18T02:00:00.000Z
CVE-2015-8288 
NETGEAR D3600 devices with firmware 1.0.0.49 and D6000 devices with firmware 1.0.0.49 and earlier use the same hardcoded private key across different customers' installations, which allows remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from another installation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-20T01:00:00.000Z
CVE-2015-8289 
The password-recovery feature on NETGEAR D3600 devices with firmware 1.0.0.49 and D6000 devices with firmware 1.0.0.49 and earlier allows remote attackers to discover the cleartext administrator password by reading the cgi-bin/passrec.asp HTML source code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-20T01:00:00.000Z
CVE-2015-8298 
Multiple SQL injection vulnerabilities in the login page in RXTEC RXAdmin UPDATE 06 / 2012 allow remote attackers to execute arbitrary SQL commands via the (1) loginpassword, (2) loginusername, (3) zusatzlicher, or (4) groupid parameter to index.htm, or the (5) rxtec cookie to index.htm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-24T19:00:00.000Z
CVE-2015-8299 
Buffer overflow in the Group messages monitor (Falcon) in KNX ETS 4.1.5 (Build 3246) allows remote attackers to execute arbitrary code via a crafted KNXnet/IP UDP packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-29T15:00:00.000Z
CVE-2015-8300 
Polycom BToE Connector before 3.0.0 uses weak permissions (Everyone: Full Control) for "Program Files (x86)\polycom\polycom btoe connector\plcmbtoesrv.exe," which allows local users to gain privileges via a Trojan horse file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-28T21:00:00.000Z
CVE-2015-8303 
Huawei Document Security Management (DSM) with software before V100R002C05SPC661 does not clear the clipboard when closing a secure file, which allows local users to obtain sensitive information by pasting the contents to another file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-08T19:00:00.000Z
CVE-2015-8304 
Integer overflow in Huawei P7 phones with software before P7-L07 V100R001C01B606 allows remote attackers to gain privileges via a crafted application with the system or camera permission.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-13T14:00:00.000Z
CVE-2015-8305 
Huawei Sophia-L10 smartphones with software before P7-L10C900B852 allow attackers to cause a denial of service (system panic) via a crafted application with the system or camera privilege.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-07T19:00:00.000Z
CVE-2015-8306 
Buffer overflow in the HIFI driver in Huawei P8 phones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL00 before GRA-UL00C00B230, and GRA-UL10 before GRA-UL10C00B230 allows attackers to cause a denial of service (system crash) or execute arbitrary code via an unspecified parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-12T19:00:00.000Z
CVE-2015-8307 
The Graphics driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL00 before GRA-UL00C00B230, and GRA-UL10 before GRA-UL10C00B230, and Mate S smartphones with software CRR-TL00 before CRR-TL00C01B160SP01, CRR-UL00 before CRR-UL00C00B160, and CRR-CL00 before CRR-CL00C92B161 allows attackers to cause a denial of service (system crash) or gain privileges via a crafted application with the graphics permission, aka an "interface access control vulnerability," a different vulnerability than CVE-2015-8680.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-07T20:00:00.000Z
CVE-2015-8308 
LXDM before 0.5.2 did not start X server with -auth, which allows local users to bypass authentication with X connections.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-24T20:00:00.000Z
CVE-2015-8309 
Directory traversal vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to read arbitrary files via the "value" parameter to "download."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-27T15:00:00.000Z
CVE-2015-8310 
Cross-site scripting (XSS) vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to inject arbitrary web script or HTML via the playlistname field when creating a new playlist.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-27T15:00:00.000Z
CVE-2015-8312 
Off-by-one error in afs_pioctl.c in OpenAFS before 1.6.16 might allow local users to cause a denial of service (memory overwrite and system crash) via a pioctl with an input buffer size of 4096 bytes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-13T16:00:00.000Z
CVE-2015-8313 
GnuTLS incorrectly validates the first byte of padding in CBC modes
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-20T13:10:23.000Z
CVE-2015-8314 
The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary to obtain unauthorized persistent application access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-12T00:00:00.000Z
CVE-2015-8315 
The ms package before 0.7.1 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "regular expression denial of service (ReDoS)."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-23T21:00:00.000Z
CVE-2015-8316 
Array index error in LightDM (aka Light Display Manager) 1.14.3, 1.16.x before 1.16.6 when the XDMCP server is enabled allows remote attackers to cause a denial of service (process crash) via an XDMCP request packet with no address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-06T21:00:00.000Z
CVE-2015-8317 
The xmlParseXMLDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive information via an (1) unterminated encoding value or (2) incomplete XML declaration in XML data, which triggers an out-of-bounds heap read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-15T21:00:00.000Z
CVE-2015-8318 
Heap-based buffer overflow in the HIFI driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL00 before GRA-UL00C00B230, and GRA-UL10 before GRA-UL10C00B230, and Mate S smartphones with software CRR-TL00 before CRR-TL00C01B160SP01, CRR-UL00 before CRR-UL00C00B160, and CRR-CL00 before CRR-CL00C92B161 allows attackers to cause a denial of service (system crash) or gain privileges via a crafted application, a different vulnerability than CVE-2015-8319.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-07T20:00:00.000Z
CVE-2015-8319 
Heap-based buffer overflow in the HIFI driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL00 before GRA-UL00C00B230, and GRA-UL10 before GRA-UL10C00B230, and Mate S smartphones with software CRR-TL00 before CRR-TL00C01B160SP01, CRR-UL00 before CRR-UL00C00B160, and CRR-CL00 before CRR-CL00C92B161 allows attackers to cause a denial of service (system crash) or gain privileges via a crafted application, a different vulnerability than CVE-2015-8318.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-07T20:00:00.000Z
CVE-2015-8320 
Apache Cordova-Android before 3.7.0 improperly generates random values for BridgeSecret data, which makes it easier for attackers to conduct bridge hijacking attacks by predicting a value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-23T11:00:00.000Z
CVE-2015-8322 
NetApp OnCommand System Manager 8.3.x before 8.3.2 allows remote authenticated users to execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-07T17:00:00.000Z
CVE-2015-8324 
The ext4 implementation in the Linux kernel before 2.6.34 does not properly track the initialization of certain data structures, which allows physically proximate attackers to cause a denial of service (NULL pointer dereference and panic) via a crafted USB device, related to the ext4_fill_super function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-02T10:00:00.000Z
CVE-2015-8325 
The do_setup_env function in session.c in sshd in OpenSSH through 7.2p2, when the UseLogin feature is enabled and PAM is configured to read .pam_environment files in user home directories, allows local users to gain privileges by triggering a crafted environment for the /bin/login program, as demonstrated by an LD_PRELOAD environment variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-01T00:00:00.000Z
CVE-2015-8326 
The IPTables-Parse module before 1.6 for Perl allows local users to write to arbitrary files owned by the current user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-07T14:00:00.000Z
CVE-2015-8327 
Incomplete blacklist vulnerability in util.c in foomatic-rip in cups-filters 1.0.42 before 1.2.0 and in foomatic-filters in Foomatic 4.0.x allows remote attackers to execute arbitrary commands via ` (backtick) characters in a print job.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-17T19:00:00.000Z
CVE-2015-8328 
Unspecified vulnerability in the NVAPI support layer in the NVIDIA GPU graphics driver R340 before 341.92, R352 before 354.35, and R358 before 358.87 on Windows allows local users to obtain sensitive information, cause a denial of service (crash), or possibly gain privileges via unknown vectors.  NOTE: this identifier was SPLIT from CVE-2015-7869 per ADT2 and ADT3 due to different vulnerability types and affected versions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-24T20:00:00.000Z
CVE-2015-8329 
SAP Manufacturing Integration and Intelligence (aka MII, formerly xMII) uses weak encryption (Base64 and DES), which allows attackers to conduct downgrade attacks and decrypt passwords via unspecified vectors, aka SAP Security Note 2240274.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-24T20:00:00.000Z
CVE-2015-8330 
The PCo agent in SAP Plant Connectivity (PCo) allows remote attackers to cause a denial of service (memory corruption and agent crash) via crafted xMII requests, aka SAP Security Note 2238619.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-24T20:00:00.000Z
CVE-2015-8331 
The Operation and Maintenance Unit (OMU) in Huawei VCN500 with software before V100R002C00SPC200 does not properly invalidate the session ID when an "abnormal exit" occurs, which allows remote attackers to conduct replay attacks via the session ID.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-11T15:00:00.000Z
CVE-2015-8332 
Huawei Video Content Management (VCM) before V100R001C10SPC001 does not properly "authenticate online user identities and privileges," which allows remote authenticated users to gain privileges and perform a case operation as another user via a crafted message, aka "Horizontal Privilege Escalation Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-28T21:00:00.000Z
CVE-2015-8333 
The Operation and Maintenance Unit (OMU) in Huawei VCN500 with software before V100R002C00SPC200 allows remote authenticated users to change the IP address of the media server via crafted packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-11T15:00:00.000Z
CVE-2015-8334 
SQL injection vulnerability in the Operation and Maintenance Unit (OMU) in Huawei VCN500 before V100R002C00SPC201 allows remote authenticated users to execute arbitrary SQL commands via a crafted HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-29T15:00:00.000Z
CVE-2015-8335 
Huawei VCN500 with software before V100R002C00SPC201 logs passwords in cleartext, which allows remote authenticated users to obtain sensitive information by triggering log generation and then reading the log.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-11T15:00:00.000Z
CVE-2015-8336 
Huawei FusionCompute with software before V100R005C10SPC700 allows remote authenticated users to obtain sensitive "role and permission" information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-14T15:00:00.000Z
CVE-2015-8337 
The HIFI driver in Huawei P8 phones with software GRA-TL00 before GRA-TL00C01B220SP01, GRA-CL00 before GRA-CL00C92B220, GRA-CL10 before GRA-CL10C92B220, GRA-UL00 before GRA-UL00C00B220, GRA-UL10 before GRA-UL10C00B220 and Mate7 phones with software MT7-UL00 before MT7-UL00C17B354, MT7-TL10 before MT7-TL10C00B354, MT7-TL00 before MT7-TL00C01B354, and MT7-CL00 before MT7-CL00C92B354 allows remote attackers to cause a denial of service (invalid memory access and reboot) via unspecified vectors related to "input null pointer as parameter."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-12T19:00:00.000Z
CVE-2015-8338 
Xen 4.6.x and earlier does not properly enforce limits on page order inputs for the (1) XENMEM_increase_reservation, (2) XENMEM_populate_physmap, (3) XENMEM_exchange, and possibly other HYPERVISOR_memory_op suboperations, which allows ARM guest OS administrators to cause a denial of service (CPU consumption, guest reboot, or watchdog timeout and host reboot) and possibly have unspecified other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-17T19:00:00.000Z
CVE-2015-8339 
The memory_exchange function in common/memory.c in Xen 3.2.x through 4.6.x does not properly hand back pages to a domain, which might allow guest OS administrators to cause a denial of service (host crash) via unspecified vectors related to domain teardown.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-17T19:00:00.000Z
CVE-2015-8340 
The memory_exchange function in common/memory.c in Xen 3.2.x through 4.6.x does not properly release locks, which might allow guest OS administrators to cause a denial of service (deadlock or host crash) via unspecified vectors, related to XENMEM_exchange error handling.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-17T19:00:00.000Z
CVE-2015-8341 
The libxl toolstack library in Xen 4.1.x through 4.6.x does not properly release mappings of files used as kernels and initial ramdisks when managing multiple domains in the same process, which allows attackers to cause a denial of service (memory and disk consumption) by starting domains.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-17T19:00:00.000Z
CVE-2015-8345 
The eepro100 emulator in QEMU qemu-kvm blank allows local guest users to cause a denial of service (application crash and infinite loop) via vectors involving the command block list.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-13T17:00:00.000Z
CVE-2015-8346 
app/views/timelog/_form.html.erb in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote attackers to obtain sensitive information about subjects of issues by viewing the time logging form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-12T14:00:00.000Z
CVE-2015-8349 
Cross-site scripting (XSS) vulnerability in SourceBans before 2.0 pre-alpha allows remote attackers to inject arbitrary web script or HTML via the advSearch parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-11T20:00:00.000Z
CVE-2015-8350 
Multiple cross-site scripting (XSS) vulnerabilities in the Calls to Action plugin before 2.5.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) open-tab parameter in a wp_cta_global_settings action to wp-admin/edit.php or (2) wp-cta-variation-id parameter to ab-testing-call-to-action-example/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-11T20:00:00.000Z
CVE-2015-8351 
PHP remote file inclusion vulnerability in the Gwolle Guestbook plugin before 1.5.4 for WordPress, when allow_url_include is enabled, allows remote authenticated users to execute arbitrary PHP code via a URL in the abspath parameter to frontend/captcha/ajaxresponse.php.  NOTE: this can also be leveraged to include and execute arbitrary local files via directory traversal sequences regardless of whether allow_url_include is enabled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-11T20:00:00.000Z
CVE-2015-8352 
Directory traversal vulnerability in Zen Cart 1.5.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the act parameter to ajax.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-24T21:00:00.000Z
CVE-2015-8353 
Cross-site scripting (XSS) vulnerability in the Role Scoper plugin before 1.3.67 for WordPress allows remote attackers to inject arbitrary web script or HTML via the object_name parameter in a rs-object_role_edit page to wp-admin/admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-11T20:00:00.000Z
CVE-2015-8354 
Cross-site scripting (XSS) vulnerability in the Ultimate Member WordPress plugin before 1.3.29 for WordPress allows remote attackers to inject arbitrary web script or HTML via the _refer parameter to wp-admin/users.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-11T20:00:00.000Z
CVE-2015-8355 
Multiple SQL injection vulnerabilities in the orion.extfeedbackform module before 2.1.3 for Bitrix allow remote authenticated users to execute arbitrary SQL commands via the (1) order or (2) "by" parameter to admin/orion.extfeedbackform_efbf_forms.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-24T21:00:00.000Z
CVE-2015-8356 
Multiple SQL injection vulnerabilities in the mcart.xls module 6.5.2 and earlier for Bitrix allow remote authenticated users to execute arbitrary SQL commands via the (1) xls_profile parameter to admin/mcart_xls_import.php or the (2) xls_iblock_id, (3) xls_iblock_section_id, (4) firstRow, (5) titleRow, (6) firstColumn, (7) highestColumn, (8) sku_iblock_id, or (9) xls_iblock_section_id_new parameter to admin/mcart_xls_import_step_2.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-14T14:00:00.000Z
CVE-2015-8357 
Directory traversal vulnerability in the bitrix.xscan module before 1.0.4 for Bitrix allows remote authenticated users to rename arbitrary files, and consequently obtain sensitive information or cause a denial of service, via a .. (dot dot) in the file parameter to admin/bitrix.xscan_worker.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-16T21:00:00.000Z
CVE-2015-8358 
Directory traversal vulnerability in the bitrix.mpbuilder module before 1.0.12 for Bitrix allows remote administrators to include and execute arbitrary local files via a .. (dot dot) in the element name of the "work" array parameter to admin/bitrix.mpbuilder_step2.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-16T21:00:00.000Z
CVE-2015-8360 
An unspecified resource in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 allows remote attackers to execute arbitrary Java code via serialized data to the JMS port.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-02-08T19:00:00.000Z
CVE-2015-8361 
Multiple unspecified services in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 do not require authentication, which allows remote attackers to obtain sensitive information, modify settings, or manage build agents via unknown vectors involving the JMS port.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-02-08T19:00:00.000Z
CVE-2015-8362 
The setUpSubtleUserAccount function in /bin/bw on Harman AMX devices before 2015-10-12 has a hardcoded password for the BlackWidow account, which makes it easier for remote attackers to obtain access via a (1) SSH or (2) HTTP session, a different vulnerability than CVE-2016-1984.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-22T11:00:00.000Z
CVE-2015-8363 
The jpeg2000_read_main_headers function in libavcodec/jpeg2000dec.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 does not enforce uniqueness of the SIZ marker in a JPEG 2000 image, which allows remote attackers to cause a denial of service (out-of-bounds heap-memory access) or possibly have unspecified other impact via a crafted image with two or more of these markers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-26T17:00:00.000Z
CVE-2015-8364 
Integer overflow in the ff_ivi_init_planes function in libavcodec/ivi.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 allows remote attackers to cause a denial of service (out-of-bounds heap-memory access) or possibly have unspecified other impact via crafted image dimensions in Indeo Video Interactive data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-26T17:00:00.000Z
CVE-2015-8365 
The smka_decode_frame function in libavcodec/smacker.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 does not verify that the data size is consistent with the number of channels, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Smacker data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-26T17:00:00.000Z