CVE-2015-4485

2015-08-1601:59:13

CWE-119

mozilla

web.nvd.nist.gov

cve-2015-4485

buffer overflow

libvpx

mozilla firefox

remote code execution

webm video data

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

AI Score

7.7

Confidence

Low

EPSS

0.018

Percentile

88.3%

JSON

Heap-based buffer overflow in the resize_context_buffers function in libvpx in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code via malformed WebM video data.

Affected configurations

Nvd

Node

mozillafirefoxRange≤39.0.3

mozillafirefox_esrMatch38.0

mozillafirefox_esrMatch38.0.1

mozillafirefox_esrMatch38.0.5

mozillafirefox_esrMatch38.1.0

Node

canonicalubuntu_linuxMatch12.04lts

canonicalubuntu_linuxMatch14.04lts

canonicalubuntu_linuxMatch15.04

opensuseopensuseMatch13.1

opensuseopensuseMatch13.2

Node

oraclesolarisMatch11.3

VendorProductVersionCPE
mozillafirefox_esr38.0.5cpe:/a:mozilla:firefox_esr:38.0.5:::
mozillafirefox_esr38.1.0cpe:/a:mozilla:firefox_esr:38.1.0:::
mozillafirefox_esr38.0.1cpe:/a:mozilla:firefox_esr:38.0.1:::
mozillafirefox_esr38.0cpe:/a:mozilla:firefox_esr:38.0:::
mozillafirefoxcpe:/a:mozilla:firefox::::

Vendor	Product	Version	CPE
mozilla	firefox_esr	38.0.5	cpe:/a:mozilla:firefox_esr:38.0.5:::
mozilla	firefox_esr	38.1.0	cpe:/a:mozilla:firefox_esr:38.1.0:::
mozilla	firefox_esr	38.0.1	cpe:/a:mozilla:firefox_esr:38.0.1:::
mozilla	firefox_esr	38.0	cpe:/a:mozilla:firefox_esr:38.0:::
mozilla	firefox		cpe:/a:mozilla:firefox::::