CVE-2015-4486

The decrease_ref_count function in libvpx in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via malformed WebM video data.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
10 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:C/I:C/A:C
mozillaCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 80%
VendorProductVersion
canonicalubuntu_linux
12.04
canonicalubuntu_linux
14.04
canonicalubuntu_linux
15.04
opensuseopensuse
13.1
opensuseopensuse
13.2
mozillafirefox
𝑥
≤ 39.0.3
mozillafirefox
38.0
mozillafirefox
38.0.1
mozillafirefox
38.0.5
mozillafirefox
38.1.0
oraclesolaris
11.3
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
libvpx
bullseye (security)
1.9.0-1+deb11u3
fixed
bullseye
1.9.0-1+deb11u3
fixed
jessie
not-affected
wheezy
not-affected
squeeze
not-affected
bookworm
1.12.0-1+deb12u3
fixed
bookworm (security)
1.12.0-1+deb12u3
fixed
sid
1.14.1-1
fixed
trixie
1.14.1-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
firefox
vivid
Fixed 40.0+build4-0ubuntu0.15.04.1
released
trusty
Fixed 40.0+build4-0ubuntu0.14.04.1
released
precise
Fixed 40.0+build4-0ubuntu0.12.04.1
released
References