Fluid Attacks Database

Description

Integer underflow in the Metadata::setData function in MetaData.cpp in libstagefright in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allows remote attackers to execute arbitrary code or cause a denial of service (incorrect memory allocation and application crash) via an MP4 video file with crafted covr metadata that triggers a buffer overflow.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
rpm rhel5	firefox	<0:38.5.0-2.el5_11	0:38.5.0-2.el5_11
rpm rhel6	firefox	<0:38.5.0-2.el6_7	0:38.5.0-2.el6_7
rpm rhel7	firefox	<0:38.5.0-3.el7_2	0:38.5.0-3.el7_2

Aliases

1. CVE-2015-72222. NVD-2015-72223. OSV-2015-7222

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.