UBUNTU-CVE-2015-4485

Heap-based buffer overflow in the resize_context_buffers function in libvpx in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code via malformed WebM video data.

References

Affected packages

Ubuntu:14.04:LTS / firefox

Package

Name: firefox
Purl: pkg:deb/ubuntu/firefox@40.0+build4-0ubuntu0.14.04.1?arch=source&distro=trusty

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

40.0+build4-0ubuntu0.14.04.1

Affected versions

24.*

24.0+build1-0ubuntu1

25.*

25.0+build3-0ubuntu0.13.10.1

28.*

28.0~b2+build1-0ubuntu2

28.0+build1-0ubuntu1

28.0+build2-0ubuntu1

28.0+build2-0ubuntu2

29.*

29.0+build1-0ubuntu0.14.04.2

30.*

30.0+build1-0ubuntu0.14.04.3

31.*

31.0+build1-0ubuntu0.14.04.1

32.*

32.0+build1-0ubuntu0.14.04.1

32.0.3+build1-0ubuntu0.14.04.1

33.*

33.0+build2-0ubuntu0.14.04.1

34.*

34.0+build2-0ubuntu0.14.04.1

35.*

35.0+build3-0ubuntu0.14.04.2

35.0.1+build1-0ubuntu0.14.04.1

36.*

36.0+build2-0ubuntu0.14.04.4

36.0.1+build2-0ubuntu0.14.04.1

36.0.4+build1-0ubuntu0.14.04.1

37.*

37.0+build2-0ubuntu0.14.04.1

37.0.1+build1-0ubuntu0.14.04.1

37.0.2+build1-0ubuntu0.14.04.1

38.*

38.0+build3-0ubuntu0.14.04.1

39.*

39.0+build5-0ubuntu0.14.04.1

39.0.3+build2-0ubuntu0.14.04.1

Ecosystem specific

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "firefox",
            "binary_version": "40.0+build4-0ubuntu0.14.04.1"
        },
        {
            "binary_name": "firefox-globalmenu",
            "binary_version": "40.0+build4-0ubuntu0.14.04.1"
        },
        {
            "binary_name": "firefox-mozsymbols",
            "binary_version": "40.0+build4-0ubuntu0.14.04.1"
        },
        {
            "binary_name": "firefox-testsuite",
            "binary_version": "40.0+build4-0ubuntu0.14.04.1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2015/UBUNTU-CVE-2015-4485.json"