CVE-2009-3378

The oggplay_data_handle_theora_frame function in
media/liboggplay/src/liboggplay/oggplay_data.c in liboggplay, as used in
Mozilla Firefox 3.5.x before 3.5.4, attempts to reuse an earlier frame data
structure upon encountering a decoding error for the first frame, which
allows remote attackers to cause a denial of service (NULL pointer
dereference and application crash) or possibly execute arbitrary code via a
crafted .ogg video file.

Bugs

• <https://bugzilla.mozilla.org/show_bug.cgi?id=500311&gt;