1. Home
  2. Vulnerabilities
  3. CVE-2015-4475

CVE-2015-4475

CVSS v2.0 7.5 (High)
75% Progress
EPSS 5.50 % (93th)
5.50% Progress
Affected Products 4
Advisories 10
Info CVSS EPSS CAPEC Affected Configurations References Security Advisories Packages & Software OVAL Tools, Exploits & PoC Graph Web & Social Timeline

The mozilla::AudioSink function in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 mishandles inconsistent sample formats within MP3 audio data, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via a malformed file.

Weaknesses
CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE Status
PUBLISHED
CNA
Mozilla Corporation
Published Date
2015-08-16 01:59:03
(9 years ago)
Updated Date
2018-10-30 16:27:35
(5 years ago)

Affected Products

Canonical

Mozilla

Opensuse

Configuration #1

    CPE23 From Up To
  Mozilla Firefox 39.0.3 and prior versions cpe:2.3:a:mozilla:firefox <= 39.0.3
  Mozilla Firefox Esr 38.0 cpe:2.3:a:mozilla:firefox_esr:38.0
  Mozilla Firefox Esr 38.0.1 cpe:2.3:a:mozilla:firefox_esr:38.0.1
  Mozilla Firefox Esr 38.0.5 cpe:2.3:a:mozilla:firefox_esr:38.0.5
  Mozilla Firefox Esr 38.1.0 cpe:2.3:a:mozilla:firefox_esr:38.1.0

Configuration #2

    CPE23 From Up To
  Canonical Ubuntu Linux 12.04 cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts
  Canonical Ubuntu Linux 14.04 cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts
  Canonical Ubuntu Linux 15.04 cpe:2.3:o:canonical:ubuntu_linux:15.04
  Opensuse 13.1 cpe:2.3:o:opensuse:opensuse:13.1
  Opensuse 13.2 cpe:2.3:o:opensuse:opensuse:13.2