CVE catalog

CVE-2015-6360

srtp - security update

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
8.28% · Oct 25, 2026

The encryption-processing feature in Cisco libSRTP before 1.5.3 allows remote attackers to cause a denial of service via crafted fields in SRTP packets, aka Bug ID CSCux00686. libsrtp: improper handling of CSRC count and extension header length in RTP header The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiansrtp6.01.4.4~dfsg-6vulnerable
Debiansrtp6.01.4.4~dfsg-6+deb6u2fixed
Debiansrtp71.4.4+20100615~dfsg-2vulnerable
Debiansrtp71.4.4+20100615~dfsg-2+deb7u1vulnerable
Debiansrtp71.4.4+20100615~dfsg-2+deb7u2fixed
Debiansrtp81.4.5~20130609~dfsg-1.1vulnerable
Debiansrtp81.4.5~20130609~dfsg-1.1+deb8u1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiansrtpdeb6.01.4.4~dfsg-6+deb6u2Not reportedDLA-393-1Not reported
Debiansrtpdeb71.4.4+20100615~dfsg-2+deb7u2Not reportedDSA-3539-1Not reported
Debiansrtpdeb81.4.5~20130609~dfsg-1.1+deb8u1Not reportedDSA-3539-1Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]