Debian Linux
CVE-2015-0797
MEDIUM
Severity by source
AV:N/AC:M/Au:N/C:P/I:P/A:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
GStreamer before 1.4.5, as used in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 on Linux, allows remote attackers to cause a denial of service (buffer over-read and application crash) or possibly execute arbitrary code via crafted H.264 video data in an m4v file.
AnalysisAI
A buffer over-read vulnerability exists in GStreamer's H.264 video decoding implementation that affects Mozilla Firefox, Firefox ESR, Thunderbird, and SeaMonkey on Linux systems. Remote attackers can trigger a denial of service (application crash) or potentially execute arbitrary code by crafting malicious H.264 video data within an m4v file. With an EPSS score of 7.61% (92nd percentile) and patches available from vendors, this vulnerability represents a moderate exploitation risk despite its CVSS 6.8 rating, indicating real-world prioritization is warranted for affected Linux deployments.
Technical ContextAI
The vulnerability resides in GStreamer before version 1.4.5, a multimedia framework library used by Firefox and Thunderbird for video playback on Linux. The root cause is improper bounds checking in the H.264 video decoder when processing crafted video frames within m4v (MPEG-4 Video) container files. GStreamer (CPE: cpe:2.3:a:gstreamer:gstreamer) is leveraged by Mozilla Firefox (cpe:2.3:a:mozilla:firefox), Firefox ESR (cpe:2.3:a:mozilla:firefox), Thunderbird (cpe:2.3:a:mozilla:thunderbird), and SeaMonkey (cpe:2.3:a:mozilla:seamonkey) for native video codec support. The vulnerability allows reading beyond allocated buffer boundaries, which can expose sensitive memory contents or be chained with other flaws to achieve code execution. While no specific CWE is listed in the CVE record, the technical indicators (buffer over-read, crafted input, memory disclosure potential) align with CWE-125 (Out-of-bounds Read).
RemediationAI
Upgrade GStreamer to version 1.4.5 or later to address the underlying vulnerability. For Firefox users, upgrade to Firefox 38.0 or later. For Firefox ESR 31.x users, upgrade to version 31.7 or later. For Thunderbird users, upgrade to version 31.7 or later. Linux distributions should apply patches from their respective security channels: SUSE users should install the gstreamer updates referenced in SUSE security announcements (opensuse-security-announce May-June 2015), Red Hat users should apply RHSA-2015-0988 or RHSA-2015-1012, and Debian users should apply DSA-3225, DSA-3260, or DSA-3264 depending on their release branch. Until patching is possible, restrict opening untrusted m4v video files and disable video playback in email clients if feasible. Monitor Firefox/Thunderbird version status and enable automatic updates where organizationally permitted. The patch is publicly available via vendor repositories and bugzilla.mozilla.org (https://bugzilla.mozilla.org/show_bug.cgi?id=1080995).
More in Debian Linux
View allApache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote c
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allo
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) o
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Rate
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. Rated critical severity (
Share
External POC / Exploit Code
Leaving vuln.today