CVE-2015-8790 - Vulnerability Details - OpenCVE

The EbmlUnicodeString::UpdateFromUTF8 function in libEBML before 1.3.3 allows context-dependent attackers to obtain sensitive information from process heap memory via a crafted UTF-8 string, which triggers an invalid memory access.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Matroska	Libebml

Configuration 1 [-]

cpe:2.3:a:matroska:libebml:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://lists.matroska.org/pipermail/matroska-users/2015-October/006985.html
http://lists.opensuse.org/opensuse-updates/2016-01/msg00035.html
http://www.debian.org/security/2016/dsa-3538
http://www.securityfocus.com/bid/85307
http://www.securityfocus.com/bid/95124
http://www.talosintelligence.com/reports/TALOS-2016-0036/
https://github.com/Matroska-Org/libebml/blob/release-1.3.3/ChangeLog
https://github.com/Matroska-Org/libebml/commit/ababb64e0c792ad2a314245233db0833ba12036b

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2016-01-29T19:00:00

Updated: 2024-08-06T08:29:22.019Z

Reserved: 2016-01-29T00:00:00

Link: CVE-2015-8790

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2016-01-29T19:59:02.157

Modified: 2025-04-12T10:46:40.837

Link: CVE-2015-8790

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2015-10-20T00:00:00", "descriptions": [{"lang": "en", "value": "The EbmlUnicodeString::UpdateFromUTF8 function in libEBML before 1.3.3 allows context-dependent attackers to obtain sensitive information from process heap memory via a crafted UTF-8 string, which triggers an invalid memory access."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-01-18T14:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "DSA-3538", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2016/dsa-3538"}, {"name": "95124", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/95124"}, {"name": "openSUSE-SU-2016:0125", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-updates/2016-01/msg00035.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Matroska-Org/libebml/commit/ababb64e0c792ad2a314245233db0833ba12036b"}, {"tags": ["x_refsource_MISC"], "url": "http://www.talosintelligence.com/reports/TALOS-2016-0036/"}, {"name": "[matroska-users] 20151020 libEBML v1.3.3, libMatroska v1.4.4 released: important fixes", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://lists.matroska.org/pipermail/matroska-users/2015-October/006985.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Matroska-Org/libebml/blob/release-1.3.3/ChangeLog"}, {"name": "85307", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/85307"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2015-8790", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The EbmlUnicodeString::UpdateFromUTF8 function in libEBML before 1.3.3 allows context-dependent attackers to obtain sensitive information from process heap memory via a crafted UTF-8 string, which triggers an invalid memory access."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "DSA-3538", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2016/dsa-3538"}, {"name": "95124", "refsource": "BID", "url": "http://www.securityfocus.com/bid/95124"}, {"name": "openSUSE-SU-2016:0125", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-updates/2016-01/msg00035.html"}, {"name": "https://github.com/Matroska-Org/libebml/commit/ababb64e0c792ad2a314245233db0833ba12036b", "refsource": "CONFIRM", "url": "https://github.com/Matroska-Org/libebml/commit/ababb64e0c792ad2a314245233db0833ba12036b"}, {"name": "http://www.talosintelligence.com/reports/TALOS-2016-0036/", "refsource": "MISC", "url": "http://www.talosintelligence.com/reports/TALOS-2016-0036/"}, {"name": "[matroska-users] 20151020 libEBML v1.3.3, libMatroska v1.4.4 released: important fixes", "refsource": "MLIST", "url": "http://lists.matroska.org/pipermail/matroska-users/2015-October/006985.html"}, {"name": "https://github.com/Matroska-Org/libebml/blob/release-1.3.3/ChangeLog", "refsource": "CONFIRM", "url": "https://github.com/Matroska-Org/libebml/blob/release-1.3.3/ChangeLog"}, {"name": "85307", "refsource": "BID", "url": "http://www.securityfocus.com/bid/85307"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T08:29:22.019Z"}, "title": "CVE Program Container", "references": [{"name": "DSA-3538", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2016/dsa-3538"}, {"name": "95124", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/95124"}, {"name": "openSUSE-SU-2016:0125", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-updates/2016-01/msg00035.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/Matroska-Org/libebml/commit/ababb64e0c792ad2a314245233db0833ba12036b"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.talosintelligence.com/reports/TALOS-2016-0036/"}, {"name": "[matroska-users] 20151020 libEBML v1.3.3, libMatroska v1.4.4 released: important fixes", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://lists.matroska.org/pipermail/matroska-users/2015-October/006985.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/Matroska-Org/libebml/blob/release-1.3.3/ChangeLog"}, {"name": "85307", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/85307"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2015-8790", "datePublished": "2016-01-29T19:00:00", "dateReserved": "2016-01-29T00:00:00", "dateUpdated": "2024-08-06T08:29:22.019Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:matroska:libebml:*:*:*:*:*:*:*:*", "matchCriteriaId": "96E02511-A860-4F99-9DD2-37F63856A267", "versionEndIncluding": "1.3.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The EbmlUnicodeString::UpdateFromUTF8 function in libEBML before 1.3.3 allows context-dependent attackers to obtain sensitive information from process heap memory via a crafted UTF-8 string, which triggers an invalid memory access."}, {"lang": "es", "value": "La funci\u00f3n EbmlUnicodeString::UpdateFromUTF8 en libEBML en versiones anteriores a 1.3.3 permite a atacantes dependientes del contexto obtener informaci\u00f3n sensible desde la memoria din\u00e1mica de proceso a trav\u00e9s de una cadena UTF-8 manipulada, lo que desencadena un acceso de memoria no v\u00e1lido."}], "id": "CVE-2015-8790", "lastModified": "2025-04-12T10:46:40.837", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2016-01-29T19:59:02.157", "references": [{"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://lists.matroska.org/pipermail/matroska-users/2015-October/006985.html"}, {"source": "cve@mitre.org", "url": "http://lists.opensuse.org/opensuse-updates/2016-01/msg00035.html"}, {"source": "cve@mitre.org", "url": "http://www.debian.org/security/2016/dsa-3538"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/85307"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/95124"}, {"source": "cve@mitre.org", "url": "http://www.talosintelligence.com/reports/TALOS-2016-0036/"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://github.com/Matroska-Org/libebml/blob/release-1.3.3/ChangeLog"}, {"source": "cve@mitre.org", "url": "https://github.com/Matroska-Org/libebml/commit/ababb64e0c792ad2a314245233db0833ba12036b"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://lists.matroska.org/pipermail/matroska-users/2015-October/006985.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-updates/2016-01/msg00035.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.debian.org/security/2016/dsa-3538"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/85307"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/95124"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.talosintelligence.com/reports/TALOS-2016-0036/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://github.com/Matroska-Org/libebml/blob/release-1.3.3/ChangeLog"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/Matroska-Org/libebml/commit/ababb64e0c792ad2a314245233db0833ba12036b"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}]}