PT-2015-4882 · Mozilla+4 · Firefox+6

Aki Helin · Published 2015-04-15 · Updated 2024-10-22 · CVE-2015-0797

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GStreamer versions prior to 1.4.5 Mozilla Firefox versions prior to 38.0 Firefox ESR 31.x versions prior to 31.7 Thunderbird versions prior to 31.7

Description The issue allows remote attackers to cause a denial of service (buffer over-read and application crash) or possibly execute arbitrary code via crafted H.264 video data in an m4v file.

Recommendations For GStreamer versions prior to 1.4.5, update to version 1.4.5 or later. For Mozilla Firefox versions prior to 38.0, update to version 38.0 or later. For Firefox ESR 31.x versions prior to 31.7, update to version 31.7 or later. For Thunderbird versions prior to 31.7, update to version 31.7 or later.

Fix

Related Identifiers

CESA-2015_0988

CVE-2015-0797

DLA-2164-1

DSA-3225-1

DSA-3260-1

DSA-3264-1

MGASA-2015-0188

RHSA-2015:0988

RHSA-2015_0988

SUSE-SU-2015:0942-1

SUSE-SU-2015:0960-1

SUSE-SU-2015_0921-1

SUSE-SU-2015_0942-1

SUSE-SU-2015_0960-1

SUSE-SU-2015_0978-1

Affected Products

Centos

Firefox Esr

Gstreamer

Firefox

Red Hat

Suse

Thunderbird

References · 92

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3079 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00054.html · Vendor Advisory
• https://security.gentoo.org/glsa/201512-07 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3264-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2015:0942-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00017.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5843 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2708 · Security Note
• https://bugzilla.mozilla.org/show_bug.cgi?id=1080995 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-0797 · Security Note
• https://security-tracker.debian.org/tracker/source-package/iceweasel · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2164-1 · Vendor Advisory
• http://debian.org/security/2015/dsa-3260 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0988.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-0797 · Vendor Advisory