CVE-2015-8790 The EbmlUnicodeString::UpdateFromUTF8 function in libEBML before 1.3.3 allows context-dependent attackers to obtain sensitive information from process heap memory via a crafted UTF-8 string, which tri...
MediumCVSS 4.3
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The EbmlUnicodeString::UpdateFromUTF8 function in libEBML before 1.3.3 allows context-dependent attackers to obtain sensitive information from process heap memory via a crafted UTF-8 string, which triggers an invalid memory access.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libebml(Debian:12) | < 1.3.3-1 | 1.3.3-1 |
| debian/libebml(Debian:13) | < 1.3.3-1 | 1.3.3-1 |
| debian/libebml(Debian:14) | < 1.3.3-1 | 1.3.3-1 |
| matroska libebml | <= 1.3.2 | No fix listed |
References
- Debian Security Tracker CVE-2015-8790 vendor-advisory
- [matroska-users] 20151020 libEBML v1.3.3, libMatroska v1.4.4 released: important fixes mailing-list vendor-advisory
- openSUSE-SU-2016:0125 vendor-advisory
- DSA-3538 vendor-advisory
- 85307 vdb-entry
- 95124 vdb-entry
- www.talosintelligence.com
- github.com vendor-advisory
- github.com