CVEs-PoC/2015/CVE-2015-1224.md

CVE-2015-1224

Description

The VpxVideoDecoder::VpxDecode function in media/filters/vpx_video_decoder.cc in the vpxdecoder implementation in Google Chrome before 41.0.2272.76 does not ensure that alpha-plane dimensions are identical to image dimensions, which allows remote attackers to cause a denial of service (out-of-bounds read) via crafted VPx video data.

POC

Reference

No PoCs from references.

Github

• https://github.com/Hwangtaewon/radamsa
• https://github.com/JulianDavis/radamsa
• https://github.com/StephenHaruna/RADAMSA
• https://github.com/marcostolosa/radamsa
• https://github.com/nqwang/radamsa
• https://github.com/sambacha/mirror-radamsa
• https://github.com/sunzu94/radamsa-Fuzzer
• https://github.com/vnc0/radamsa-ios