PT-2009-5685 · Mozilla+1 · Firefox+1

Juan Becerra + 1 · Published 2009-10-29 · Updated 2024-06-15 · CVE-2009-3378

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions liboggplay versions prior to 3.5.4 Mozilla Firefox versions 3.5.x before 3.5.4

Description The issue is related to the oggplay data handle theora frame function in liboggplay, which can cause a denial of service or possibly execute arbitrary code when encountering a decoding error for the first frame in a crafted .ogg video file. This is due to the function attempting to reuse an earlier frame data structure, leading to a NULL pointer dereference and application crash.

Recommendations For liboggplay versions prior to 3.5.4, update to version 3.5.4 or later to resolve the issue. For Mozilla Firefox versions 3.5.x before 3.5.4, update to version 3.5.4 or later to resolve the issue.

Fix

Related Identifiers

CVE-2009-3378

OPENSUSE-SU-2024:10071-1

Affected Products

Firefox

Liboggplay

References · 910

• https://osv.dev/vulnerability/DEBIAN-CVE-2009-3378 · Vendor Advisory
• http://mozilla.org/security/announce/2009/mfsa2009-63.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2009-3378 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2009-3378 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-272909-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2009:294 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-3378 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10071-1 · Vendor Advisory
• https://suse.com/security/cve/CVE-2012-2808 · Note
• https://suse.com/security/cve/CVE-2012-0444 · Note
• https://suse.com/security/cve/CVE-2012-1954 · Note
• https://suse.com/security/cve/CVE-2013-1714 · Note
• https://suse.com/security/cve/CVE-2011-0068 · Note
• https://suse.com/security/cve/CVE-2010-0167 · Note
• https://suse.com/security/cve/CVE-2015-0806 · Note