CVE-2015-0797 GStreamer before 1.4.5, as used in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 on Linux, allows remote attackers to cause a denial of service (buffer over-re...
MediumCVSS 6.8
EPSS 5.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
GStreamer before 1.4.5, as used in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 on Linux, allows remote attackers to cause a denial of service (buffer over-read and application crash) or possibly execute arbitrary code via crafted H.264 video data in an m4v file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| GStreamer | < 1.4.5 | 1.4.5 |
| mozilla Firefox | < 38.0 | 38.0 |
| mozilla Firefox | >= 31.0, < 31.7 | 31.7 |
| mozilla seamonkey | < 2.35 | 2.35 |
| mozilla Thunderbird | < 31.7 | 31.7 |
| mozilla Thunderbird | >= 38.0, < 38.0.1 | 38.0.1 |
| SUSE linux enterprise desktop | = 11-sp3 | No fix listed |
| SUSE linux enterprise server | = 11-sp3 | No fix listed |
| SUSE linux enterprise software development kit | = 11-sp3 | No fix listed |
| redhat enterprise linux desktop | = 5.0 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux eus | = 6.6 | No fix listed |
| redhat enterprise linux eus | = 7.1 | No fix listed |
| redhat enterprise linux eus | = 7.2 | No fix listed |
| redhat enterprise linux eus | = 7.3 | No fix listed |
| redhat enterprise linux eus | = 7.4 | No fix listed |
| redhat enterprise linux eus | = 7.5 | No fix listed |
| redhat enterprise linux eus | = 7.6 | No fix listed |
| redhat enterprise linux eus | = 7.7 | No fix listed |
| redhat enterprise linux server | = 5.0 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server aus | = 6.6 | No fix listed |
| redhat enterprise linux server aus | = 7.3 | No fix listed |
Show 13 more
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat enterprise linux server aus | = 7.4 | No fix listed |
| redhat enterprise linux server aus | = 7.6 | No fix listed |
| redhat enterprise linux server aus | = 7.7 | No fix listed |
| redhat enterprise linux server tus | = 6.6 | No fix listed |
| redhat enterprise linux server tus | = 7.3 | No fix listed |
| redhat enterprise linux server tus | = 7.6 | No fix listed |
| redhat enterprise linux server tus | = 7.7 | No fix listed |
| redhat enterprise linux workstation | = 5.0 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
References
- SUSE-SU-2015:0921 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2015:0960 broken-link vendor-advisory
- SUSE-SU-2015:0978 mailing-list third-party-advisory vendor-advisory
- RHSA-2015:0988 third-party-advisory vendor-advisory
- RHSA-2015:1012 third-party-advisory vendor-advisory
- DSA-3225 third-party-advisory vendor-advisory
- DSA-3260 third-party-advisory vendor-advisory
- DSA-3264 third-party-advisory vendor-advisory
- www.mozilla.org vendor-advisory
- www.oracle.com third-party-advisory
- bugzilla.mozilla.org issue-tracking patch vendor-advisory
- [debian-lts-announce] 20200331 [SECURITY] [DLA 2164-1] gst-plugins-bad0.10 security update mailing-list third-party-advisory
- GLSA-201512-07 third-party-advisory vendor-advisory
- www.mozilla.org vendor-advisory