NVD Vulnerability Detail

CVE-2015-4493

Summary	Heap-based buffer overflow in the stagefright::ESDS::parseESDescriptor function in libstagefright in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code via an invalid size field in an esds chunk in MPEG-4 video data, a related issue to CVE-2015-1539.
Publication Date	Aug. 16, 2015, 10:59 a.m.
Registration Date	Jan. 26, 2021, 2:51 p.m.
Last Update	Nov. 21, 2024, 11:31 a.m.

CVSS2.0 : HIGH
Score	9.3
Vector	AV:N/AC:M/Au:N/C:C/I:C/A:C
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	中
攻撃前の認証要否(Au)	不要
機密性への影響(C)	高
完全性への影響(I)	高
可用性への影響(A)	高
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	はい

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:o:oracle:solaris:11.3:::::::*

Configuration2	or higher	or less	more than	less than
cpe:2.3:a:mozilla:firefox::::::::		39.0.3
cpe:2.3:a:mozilla:firefox:38.0:::::::*
cpe:2.3:a:mozilla:firefox:38.1.0:::::::*
cpe:2.3:a:mozilla:firefox:38.0.1:::::::*
cpe:2.3:a:mozilla:firefox:38.0.5:::::::*

Configuration3	or higher	or less	more than	less than
cpe:2.3:o:canonical:ubuntu_linux:12.04::::lts:::
cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts:::
cpe:2.3:o:canonical:ubuntu_linux:15.04:::::::*
cpe:2.3:o:opensuse:opensuse:13.1:::::::*
cpe:2.3:o:opensuse:opensuse:13.2:::::::*

Related information, measures and tools

No	URL	タグ
1	http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html	Third Party Advisory
2	http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html	Third Party Advisory
3	http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00015.html	Third Party Advisory
4	http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00015.html	Third Party Advisory
5	http://lists.opensuse.org/opensuse-updates/2015-08/msg00030.html
6	http://lists.opensuse.org/opensuse-updates/2015-08/msg00030.html
7	http://lists.opensuse.org/opensuse-updates/2015-08/msg00031.html
8	http://lists.opensuse.org/opensuse-updates/2015-08/msg00031.html
9	http://rhn.redhat.com/errata/RHSA-2015-1586.html
10	http://rhn.redhat.com/errata/RHSA-2015-1586.html
11	http://www.debian.org/security/2015/dsa-3333
12	http://www.debian.org/security/2015/dsa-3333
13	http://www.mozilla.org/security/announce/2015/mfsa2015-83.html	Vendor Advisory
14	http://www.mozilla.org/security/announce/2015/mfsa2015-83.html	Vendor Advisory
15	http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html	Third Party Advisory
16	http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html	Third Party Advisory
17	http://www.securitytracker.com/id/1033247
18	http://www.securitytracker.com/id/1033247
19	http://www.ubuntu.com/usn/USN-2702-1	Third Party Advisory
20	http://www.ubuntu.com/usn/USN-2702-1	Third Party Advisory
21	http://www.ubuntu.com/usn/USN-2702-2	Third Party Advisory
22	http://www.ubuntu.com/usn/USN-2702-2	Third Party Advisory
23	http://www.ubuntu.com/usn/USN-2702-3
24	http://www.ubuntu.com/usn/USN-2702-3
25	https://bugzilla.mozilla.org/show_bug.cgi?id=1186718	Issue Tracking
26	https://bugzilla.mozilla.org/show_bug.cgi?id=1186718	Issue Tracking
27	https://hg.mozilla.org/mozilla-central/rev/a674c7019cb5
28	https://hg.mozilla.org/mozilla-central/rev/a674c7019cb5
29	https://security.gentoo.org/glsa/201605-06
30	https://security.gentoo.org/glsa/201605-06

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-119	バッファエラー	https://cwe.mitre.org/data/definitions/118.html

JVN Vulnerability Information

Mozilla Firefox の libstagefright の stagefright::ESDS::parseESDescriptor 関数におけるヒープベースのバッファオーバーフローの脆弱性

Title	Mozilla Firefox の libstagefright の stagefright::ESDS::parseESDescriptor 関数におけるヒープベースのバッファオーバーフローの脆弱性
Summary	Mozilla Firefox の libstagefright の stagefright::ESDS::parseESDescriptor 関数には、ヒープベースのバッファオーバーフローの脆弱性が存在します。本件は CVE-2015-1539 に関連した問題です。
Possible impacts	第三者により、MPEG-4 動画データの ESDS チャンクの不正な size フィールドを介して、任意のコードを実行される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Aug. 11, 2015, midnight
Registration Date	Aug. 19, 2015, 5:16 p.m.
Last Update	Oct. 6, 2015, 6:04 p.m.

Affected System

Mozilla Foundation

Mozilla Firefox 40.0 未満

Mozilla Firefox ESR 38.2 未満の 38.x

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2015-4493	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4493
National Vulnerability Database (NVD)
2	CVE-2015-4493	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4493

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-119	https://jvndb.jvn.jp/ja/cwe/CWE-119.html

ベンダー情報

No	Name	URL
Mozilla
1	Bug 1186718 - Ensure ESDS have valid size. r=kentuckyfriedtakahe	https://hg.mozilla.org/mozilla-central/rev/a674c7019cb5
Mozilla Foundation Security Advisory
2	MFSA2015-83	https://www.mozilla.org/en-US/security/advisories/mfsa2015-83/
Mozilla Foundation セキュリティアドバイザリ
3	MFSA2015-83	http://www.mozilla-japan.org/security/announce/2015/mfsa2015-83.html

Change Log

No	Changed Details	Date of change
0	[2015年08月19日] 掲載 [2015年10月06日] 概要：内容を更新ベンダ情報：Mozilla Foundation (Bug 1186718 - Ensure ESDS have valid size. r=kentuckyfriedtakahe) を追加	Feb. 17, 2018, 10:37 a.m.