CVE-2015-4493
HighSummary
A heap-based buffer overflow in the libstagefright library in Mozilla Firefox before version 40.0 and Firefox ESR 38.x before version 38.2 allows remote attackers to execute arbitrary code via an invalid size field in an esds chunk in MPEG-4 video data.
Risk Assessment
This vulnerability could lead to remote code execution, posing a serious security threat to systems using the affected versions of the browser. Attackers could exploit this flaw to gain control over the victim's system.
Recommendation
It is recommended to update Mozilla Firefox to version 40.0 or later and Firefox ESR to version 38.2 or later to mitigate this vulnerability.
Other vulnerabilities in libstagefright
See all- CVE-2017-0409High
CVE-2017-0409 is a vulnerability in the libstagefright library that allows an attacker to execute arbitrary code remotely using a specially crafted file in the context of an unprivileged process. This issue is rated as High due to the potential for remote code execution in applications using this library.
- CVE-2016-3872High
Buffer overflow in SoftVPX.cpp in libstagefright in mediaserver in Android before version 4.4.4, 5.0.2, 5.1.1, 2016-09-01 for 6.x, and 2016-09-01 for 7.0 allows attackers to gain privileges via a crafted application.
- CVE-2016-3863High
Multiple stack-based buffer overflows in the AVCC reassembly implementation in libstagefright in Android allow remote attackers to execute arbitrary code via a crafted media file.
- CVE-2016-3824High
The OMXNodeInstance.cpp file in libstagefright in mediaserver in Android versions before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 does not validate the buffer port, allowing attackers to gain privileges via a crafted application.
- CVE-2016-2507High
Integer overflow in libstagefright in Android before version 4.4.4, 5.0.2, 5.1.1, and 6.x before July 1, 2016 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted media file.
- CVE-2016-2485High
libstagefright in mediaserver in Android versions before 4.4.4, 5.0.2, 5.1.1, and before June 1, 2016, does not validate OMX buffer sizes for GSM and G711 codecs. This allows attackers to gain privileges via a crafted application.
- CVE-2016-2451High
In libstagefright in Android before version 4.4.4, 5.0.2, 5.1.1, and 6.x before May 1, 2016, VPX output buffer sizes are not validated, allowing attackers to gain privileges via a crafted application.
- CVE-2016-2814High
A heap-based buffer overflow in the libstagefright library in Mozilla Firefox before version 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45.x before 45.1 allows remote attackers to execute arbitrary code via crafted CENC offsets that lead to mismanagement of the sizes table.
- CVE-2016-0842High
The H.264 decoder in libstagefright in Android 6.x before 2016-04-01 mishandles Memory Management Control Operation (MMCO) data, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
- CVE-2015-6620High
libstagefright in Android before 5.1.1 LMY48Z and 6.0 before December 1, 2015, allows attackers to gain privileges via a crafted application. This can lead to obtaining Signature or SignatureOrSystem access.
Original NVD description (English source)
Heap-based buffer overflow in the stagefright::ESDS::parseESDescriptor function in libstagefright in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code via an invalid size field in an esds chunk in MPEG-4 video data, a related issue to CVE-2015-1539.