Lucene search

Mozilla FoundationMFSA2015-101

HistorySep 22, 2015 - 12:00 a.m.

Buffer overflow in libvpx while parsing vp9 format video — Mozilla

2015-09-2200:00:00

Mozilla Foundation

www.mozilla.org

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.094 Low

EPSS

Percentile

94.8%

JSON

Security researcher Khalil Zhani reported that a maliciously crafted vp9 format video could be used to trigger a buffer overflow while parsing the file. This leads to a potentially exploitable crash due to a flaw in the libvpx library.

Affected configurations

Vulners

Node

mozillafirefoxRange<41

mozillafirefox_esrRange<38.3

mozillaseamonkeyRange<2.38

mozillathunderbirdRange<38.3

CPENameOperatorVersion
firefoxlt41
firefox esrlt38.3
seamonkeylt2.38
thunderbirdlt38.3

Name	Operator	Version
firefox	lt	41
firefox esr	lt	38.3
seamonkey	lt	2.38
thunderbird	lt	38.3

References

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4506

bugzilla.mozilla.org/show_bug.cgi?id=1192226

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.094 Low

EPSS

Percentile

94.8%

JSON

Related for MFSA2015-101