1. Home
  2. Vulnerabilities
  3. CVE-2015-4493

CVE-2015-4493

CVSS v2.0 9.3 (High)
93% Progress
EPSS 1.98 % (89th)
1.98% Progress
Affected Products 5
Advisories 7
Info CVSS EPSS CAPEC Affected Configurations References Security Advisories Packages & Software OVAL Tools, Exploits & PoC Graph Web & Social Timeline

Heap-based buffer overflow in the stagefright::ESDS::parseESDescriptor function in libstagefright in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code via an invalid size field in an esds chunk in MPEG-4 video data, a related issue to CVE-2015-1539.

Weaknesses
CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
Related CVEs
CVE Status
PUBLISHED
CNA
Mozilla Corporation
Published Date
2015-08-16 01:59:21
(9 years ago)
Updated Date
2018-10-30 16:27:35
(5 years ago)

Affected Products

Canonical

Mozilla

Opensuse

Oracle

Configuration #1

    CPE23 From Up To
  Oracle Solaris 11.3 cpe:2.3:o:oracle:solaris:11.3

Configuration #2

    CPE23 From Up To
  Mozilla Firefox 39.0.3 and prior versions cpe:2.3:a:mozilla:firefox <= 39.0.3
  Mozilla Firefox Esr 38.0 cpe:2.3:a:mozilla:firefox_esr:38.0
  Mozilla Firefox Esr 38.0.1 cpe:2.3:a:mozilla:firefox_esr:38.0.1
  Mozilla Firefox Esr 38.0.5 cpe:2.3:a:mozilla:firefox_esr:38.0.5
  Mozilla Firefox Esr 38.1.0 cpe:2.3:a:mozilla:firefox_esr:38.1.0

Configuration #3

    CPE23 From Up To
  Canonical Ubuntu Linux 12.04 cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts
  Canonical Ubuntu Linux 14.04 cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts
  Canonical Ubuntu Linux 15.04 cpe:2.3:o:canonical:ubuntu_linux:15.04
  Opensuse 13.1 cpe:2.3:o:opensuse:opensuse:13.1
  Opensuse 13.2 cpe:2.3:o:opensuse:opensuse:13.2