Mozilla FoundationMFSA2015-83Overflow issues in libstagefright — Mozilla
10 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.115 Low
EPSS
Percentile
95.3%
An anonymous researcher reported, via TippingPoint’s Zero Day Initiative, two integer overflows in the libstagefright library that could be triggered by a malicious ‘saio’ chunk in an MPEG4 video. These overflows allowed for potential arbitrary code execution. This issue was independently reported by security researcher laf.intel.
Affected configurations
References
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4479
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4480
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4493
bugzilla.mozilla.org/show_bug.cgi?id=1144107
bugzilla.mozilla.org/show_bug.cgi?id=1170344
bugzilla.mozilla.org/show_bug.cgi?id=1185115
bugzilla.mozilla.org/show_bug.cgi?id=1186718
Related
10 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.115 Low
EPSS
Percentile
95.3%