Fluid Attacks Database

Description

Heap-based buffer overflow in the nestegg_track_codec_data function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allows remote attackers to execute arbitrary code via a crafted header in a WebM video.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
rpm rhel6	firefox	<0:38.3.0-2.el6_7	0:38.3.0-2.el6_7
rpm rhel7	firefox	<0:38.3.0-2.el7_1	0:38.3.0-2.el7_1
rpm rhel5	firefox	<0:38.3.0-2.el5_11	0:38.3.0-2.el5_11

Aliases

1. CVE-2015-45112. NVD-2015-45113. OSV-2015-4511

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.