« Volver al listado

CVE-2015-1207

Estado: ModificadaMedia (6.5)—

Vulnerabilidad Double-free en libavformat/mov.c en FFMPEG en Google Chrome versión 41.0.2251.0, que permitiría a atacantes remotos causar una denegación de servicio (corrupción de memoria y parada) a través de un fichero .m4a file manipulado.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Debian — Debian LinuxGoogle — Chrome

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-1207",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "chrome-cve-admin@google.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-06-06T18:29:00.213",
  "references": [
    {
      "url": "https://bugs.chromium.org/p/chromium/issues/detail?id=444539",
      "source": "chrome-cve-admin@google.com"
    },
    {
      "url": "https://gist.github.com/bittorrent3389/8fee7cdaa73d1d351ee9",
      "source": "chrome-cve-admin@google.com"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00005.html",
      "source": "chrome-cve-admin@google.com"
    },
    {
      "url": "https://bugs.chromium.org/p/chromium/issues/detail?id=444539",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://gist.github.com/bittorrent3389/8fee7cdaa73d1d351ee9",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00005.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-415"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Double-free vulnerability in libavformat/mov.c in FFMPEG in Google Chrome 41.0.2251.0 allows remote attackers to cause a denial of service (memory corruption and crash) via a crafted .m4a file."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad Double-free en libavformat/mov.c en FFMPEG en Google Chrome versión 41.0.2251.0, que permitiría a atacantes remotos causar una denegación de servicio (corrupción de memoria y parada) a través de un fichero .m4a file manipulado."
    }
  ],
  "lastModified": "2026-06-17T00:21:57.253",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:google:chrome:41.0.2251.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "72F5D33E-C150-4123-8D6A-E65F9C57B121"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "chrome-cve-admin@google.com"
}