Vulnerability Description
Heap-based buffer overflow in the stagefright::ESDS::parseESDescriptor function in libstagefright in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code via an invalid size field in an esds chunk in MPEG-4 video data, a related issue to CVE-2015-1539.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Oracle | Solaris | 11.3 |
| Mozilla | Firefox | <= 39.0.3 |
| Canonical | Ubuntu Linux | 12.04 |
| Opensuse | Opensuse | 13.1 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00015.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-updates/2015-08/msg00030.html
- http://lists.opensuse.org/opensuse-updates/2015-08/msg00031.html
- http://rhn.redhat.com/errata/RHSA-2015-1586.html
- http://www.debian.org/security/2015/dsa-3333
- http://www.mozilla.org/security/announce/2015/mfsa2015-83.htmlVendor Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlThird Party Advisory
- http://www.securitytracker.com/id/1033247
- http://www.ubuntu.com/usn/USN-2702-1Third Party Advisory
- http://www.ubuntu.com/usn/USN-2702-2Third Party Advisory
- http://www.ubuntu.com/usn/USN-2702-3
- https://bugzilla.mozilla.org/show_bug.cgi?id=1186718Issue Tracking
- https://hg.mozilla.org/mozilla-central/rev/a674c7019cb5
- https://security.gentoo.org/glsa/201605-06
FAQ
What is CVE-2015-4493?
CVE-2015-4493 is a vulnerability with a CVSS score of 9.3 (HIGH). Heap-based buffer overflow in the stagefright::ESDS::parseESDescriptor function in libstagefright in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arb...
How severe is CVE-2015-4493?
CVE-2015-4493 has been rated HIGH with a CVSS base score of 9.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2015-4493?
Check the references section above for vendor advisories and patch information. Affected products include: Oracle Solaris, Mozilla Firefox, Canonical Ubuntu Linux, Opensuse Opensuse.