CVE-2015-8270 — rtmpdump - security update

Description

The AMF3ReadString function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to cause a denial of service (invalid pointer dereference and process crash).

How to fix CVE-2015-8270

To remediate CVE-2015-8270, upgrade the affected package to a fixed version below.

Debian/rtmpdump—upgrade to 2.4+20151223.gitfa8646d.1-1 or later
Debian/rtmpdump—upgrade to 2.4+20111222.git4e06e21-1+deb7u1 or later
—upgrade to 2.4+20150115.gita107cef-1+deb8u1 or later

Is CVE-2015-8270 being exploited?

Low — EPSS is 3.2%, meaning exploitation activity has not been observed at scale.

Affected packages (3)

from 0, < 2.4+20151223.gitfa8646d.1-1
from 0, < 2.4+20111222.git4e06e21-1+deb7u1
from 0, < 2.4+20150115.gita107cef-1+deb8u1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.5	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References (1)

ADVISORYsecurity-tracker.debian.org/tracker/CVE-2015-8270