« Volver al listado

CVE-2015-4485

Estado: ModificadaAlta (10)—

Heap-based buffer overflow in the resize_context_buffers function in libvpx in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code via malformed WebM video data.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (4)

Canonical — Ubuntu LinuxMozilla — FirefoxOpensuse — OpensuseOracle — Solaris

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-4485",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "security@mozilla.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2015-08-16T01:59:13.190",
  "references": [
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@mozilla.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00015.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@mozilla.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00021.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00016.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00025.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2015-08/msg00030.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2015-08/msg00031.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2015-1586.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.mozilla.org/security/announce/2015/mfsa2015-89.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.securitytracker.com/id/1033247",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-2702-1",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-2702-2",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-2702-3",
      "source": "security@mozilla.org"
    },
    {
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1177948",
      "tags": [
        "Issue Tracking"
      ],
      "source": "security@mozilla.org"
    },
    {
      "url": "https://security.gentoo.org/glsa/201605-06",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00015.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00021.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00016.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00025.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2015-08/msg00030.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2015-08/msg00031.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2015-1586.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.mozilla.org/security/announce/2015/mfsa2015-89.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1033247",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-2702-1",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-2702-2",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-2702-3",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1177948",
      "tags": [
        "Issue Tracking"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.gentoo.org/glsa/201605-06",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Heap-based buffer overflow in the resize_context_buffers function in libvpx in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code via malformed WebM video data."
    },
    {
      "lang": "es",
      "value": "Desbordamiento del buffer basado en memoria dinámica en la función resize_context_buffers en libvpx en Mozilla Firefox en versiones anteriores a 40.0 y Firefox ESR 38.x en versiones anteriores a 38.2, permite a atacantes remotos ejecutar código arbitrario a través de datos de vídeo WebM malformados."
    }
  ],
  "lastModified": "2026-06-17T00:27:22.533",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "40AB4FC4-00EA-4C4E-81D8-170BD068B28B",
              "versionEndIncluding": "39.0.3"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:38.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "35BF0AFB-26BA-4BEA-B6B8-11CF88E951DE"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:38.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1F007CC6-9391-4E1C-A747-F3DE5E572FA5"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:38.0.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "45E9641F-430C-4B3A-BD63-EC13DBD3D1E4"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:38.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5AADD23B-A8AF-4679-990D-C29A1D6EB5CD"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B6B7CAD7-9D4E-4FDB-88E3-1E583210A01F"
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B5A6F2F3-4894-4392-8296-3B8DD2679084"
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F38D3B7E-8429-473F-BB31-FC3583EE5A5B"
            },
            {
              "criteria": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A10BC294-9196-425F-9FB0-B1625465B47F"
            },
            {
              "criteria": "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "03117DF1-3BEC-4B8D-AD63-DBBDB2126081"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "79A602C5-61FE-47BA-9786-F045B6C6DBA8"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@mozilla.org"
}