Severity by source
AV:N/AC:M/Au:N/C:P/I:P/A:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
AV:N/AC:M/Au:N/C:P/I:P/A:P
Lifecycle Timeline
3DescriptionCVE.org
GStreamer before 1.4.5, as used in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 on Linux, allows remote attackers to cause a denial of service (buffer over-read and application crash) or possibly execute arbitrary code via crafted H.264 video data in an m4v file.
AnalysisAI
A buffer over-read vulnerability exists in GStreamer's H.264 video decoding implementation that affects Mozilla Firefox, Firefox ESR, Thunderbird, and SeaMonkey on Linux systems. Remote attackers can trigger a denial of service (application crash) or potentially execute arbitrary code by crafting malicious H.264 video data within an m4v file. With an EPSS score of 7.61% (92nd percentile) and patches available from vendors, this vulnerability represents a moderate exploitation risk despite its CVSS 6.8 rating, indicating real-world prioritization is warranted for affected Linux deployments.
Technical ContextAI
The vulnerability resides in GStreamer before version 1.4.5, a multimedia framework library used by Firefox and Thunderbird for video playback on Linux. The root cause is improper bounds checking in the H.264 video decoder when processing crafted video frames within m4v (MPEG-4 Video) container files. GStreamer (CPE: cpe:2.3:a:gstreamer:gstreamer) is leveraged by Mozilla Firefox (cpe:2.3:a:mozilla:firefox), Firefox ESR (cpe:2.3:a:mozilla:firefox), Thunderbird (cpe:2.3:a:mozilla:thunderbird), and SeaMonkey (cpe:2.3:a:mozilla:seamonkey) for native video codec support. The vulnerability allows reading beyond allocated buffer boundaries, which can expose sensitive memory contents or be chained with other flaws to achieve code execution. While no specific CWE is listed in the CVE record, the technical indicators (buffer over-read, crafted input, memory disclosure potential) align with CWE-125 (Out-of-bounds Read).
RemediationAI
Upgrade GStreamer to version 1.4.5 or later to address the underlying vulnerability. For Firefox users, upgrade to Firefox 38.0 or later. For Firefox ESR 31.x users, upgrade to version 31.7 or later. For Thunderbird users, upgrade to version 31.7 or later. Linux distributions should apply patches from their respective security channels: SUSE users should install the gstreamer updates referenced in SUSE security announcements (opensuse-security-announce May-June 2015), Red Hat users should apply RHSA-2015-0988 or RHSA-2015-1012, and Debian users should apply DSA-3225, DSA-3260, or DSA-3264 depending on their release branch. Until patching is possible, restrict opening untrusted m4v video files and disable video playback in email clients if feasible. Monitor Firefox/Thunderbird version status and enable automatic updates where organizationally permitted. The patch is publicly available via vendor repositories and bugzilla.mozilla.org (https://bugzilla.mozilla.org/show_bug.cgi?id=1080995).
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote
Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and b
Share
External POC / Exploit Code
Leaving vuln.today