PT-2015-2168 · Mozilla+6 · Firefox Esr+7

Khalil Zhani · Published 2015-09-22 · Updated 2024-12-12 · CVE-2015-4506

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions libvpx versions as used in Mozilla Firefox before 41.0 Mozilla Firefox ESR versions 38.x before 38.3

Description The issue is caused by a buffer overflow in the vp9 init context buffers function in libvpx. This allows remote attackers to execute arbitrary code via a crafted VP9 file.

Recommendations For Mozilla Firefox before 41.0, update to version 41.0 or later. For Mozilla Firefox ESR versions 38.x before 38.3, update to version 38.3 or later.

Exploit

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2015-1816

ALT-PU-2016-1454

BDU:2015-11514

CESA-2015_1834

CVE-2015-4506

DSA-3365-1

OPENSUSE-SU-2015_1658-1

OPENSUSE-SU-2015_1679-1

OPENSUSE-SU-2015_1681-1

OPENSUSE-SU-2024:10071-1

OPENSUSE-SU-2024:10218-1

OPENSUSE-SU-2024:10230-1

OPENSUSE-SU-2024:14572-1

RHSA-2015:1834

RHSA-2015_1834

SUSE-SU-2015:1680-1

SUSE-SU-2015:1703-1

USN-2743-1

USN-2743-2

USN-2743-3

USN-2743-4

USN-2754-1

Affected Products

Alt Linux

Centos

Firefox

Firefox Esr

Red Hat

Suse

Ubuntu

Libvpx

References · 2493

• 🔥 https://github.com/llamakko/CVE-2015-7214 · Exploit
• https://security-tracker.debian.org/tracker/source-package/iceweasel · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-11106 · Security Note
• https://bdu.fstec.ru/vul/2016-00725 · Security Note
• https://ubuntu.com/security/CVE-2015-4517 · Vendor Advisory
• http://mozilla.org/security/announce/2015/mfsa2015-101.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4508 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4493 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1975 · Security Note
• https://osv.dev/vulnerability/USN-2743-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2798 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2795 · Security Note
• https://osv.dev/vulnerability/USN-2743-2 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4482 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4478 · Security Note