CVE-2015-8792 The KaxInternalBlock::ReadData function in libMatroska before 1.4.4 allows context-dependent attackers to obtain sensitive information from process heap memory via crafted EBML lacing, which triggers....
MediumCVSS 5.3
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The KaxInternalBlock::ReadData function in libMatroska before 1.4.4 allows context-dependent attackers to obtain sensitive information from process heap memory via crafted EBML lacing, which triggers an invalid memory access.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libmatroska(Debian:12) | < 1.4.4-1 | 1.4.4-1 |
| debian/libmatroska(Debian:13) | < 1.4.4-1 | 1.4.4-1 |
| debian/libmatroska(Debian:14) | < 1.4.4-1 | 1.4.4-1 |
| matroska libmatroska | <= 1.4.3 | No fix listed |
| openSUSE leap | = 42.1 | No fix listed |
| opensuse | = 13.1 | No fix listed |
| opensuse | = 13.2 | No fix listed |
References
- Debian Security Tracker CVE-2015-8792 vendor-advisory
- [matroska-users] 20151020 libEBML v1.3.3, libMatroska v1.4.4 released: important fixes mailing-list patch
- openSUSE-SU-2016:0125 vendor-advisory
- DSA-3526 vendor-advisory
- github.com patch
- github.com