Gstreamer
CVE-2015-0797
MEDIUM
Vulnerability Assessment
| Impact | The CVSS vector AV:N/AC:M/Au:N/C:P/I:P/A:P indicates network-accessible attack complexity (requires user interaction such as opening a crafted media file), no authentication, and impact across confidentiality, integrity, and availability. The EPSS score of 7.61% at the 92nd percentile suggests moderate but meaningful exploitation probability in real-world networks, reflecting that while H.264 m4v files are common, reliable exploitation requires both user interaction and successful memory corruption. The vulnerability is NOT listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating no confirmed active exploitation in the wild as of publication, though the patch references and vendor advisories from Mozilla, Red Hat, Debian, and SUSE from May-June 2015 demonstrate rapid coordinated response. The combination of moderate CVSS, moderate EPSS, absence from KEV, and availability of patches suggests this should be prioritized for patching on actively used systems but is not an emergency compared to actively exploited flaws. The attack complexity requirement (user must open a malicious file) reduces immediate risk in server environments but increases risk for end-user desktop deployments. |
| Exploit ScenarioDerived | An attacker crafts a malicious m4v video file containing specifically malformed H.264 video data designed to trigger a buffer over-read in GStreamer's decoder. The attacker hosts this file on a web server or distributes it via email as an attachment. When a victim using Firefox, Thunderbird, or another affected application attempts to play the video (either by clicking a link or opening an attachment), the buffer over-read condition is triggered. This causes the application to read and potentially expose adjacent memory contents or crash, achieving either information disclosure (if memory leakage is exploited) or denial of service. Successful remote code execution would require additional memory corruption exploitation techniques beyond the buffer over-read itself. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 17, 2026
A buffer over-read vulnerability exists in GStreamer's H.264 video decoding implementation that affects Mozilla Firefox, Firefox ESR, Thunderbird, and SeaMonkey on Linux systems. Remote attackers can trigger a denial of service (application crash) or potentially execute arbitrary code by crafting malicious H.264 video data within an m4v file. With an EPSS score of 7.61% (92nd percentile) and patches available from vendors, this vulnerability represents a moderate exploitation risk despite its CVSS 6.8 rating, indicating real-world prioritization is warranted for affected Linux deployments.
RemediationAI
Upgrade GStreamer to version 1.4.5 or later to address the underlying vulnerability. For Firefox users, upgrade to Firefox 38.0 or later. For Firefox ESR 31.x users, upgrade to version 31.7 or later. For Thunderbird users, upgrade to version 31.7 or later. Linux distributions should apply patches from their respective security channels: SUSE users should install the gstreamer updates referenced in SUSE security announcements (opensuse-security-announce May-June 2015), Red Hat users should apply RHSA-2015-0988 or RHSA-2015-1012, and Debian users should apply DSA-3225, DSA-3260, or DSA-3264 depending on their release branch. Until patching is possible, restrict opening untrusted m4v video files and disable video playback in email clients if feasible. Monitor Firefox/Thunderbird version status and enable automatic updates where organizationally permitted. The patch is publicly available via vendor repositories and bugzilla.mozilla.org (https://bugzilla.mozilla.org/show_bug.cgi?id=1080995).
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in GStreamer before version 1.4.5, a multimedia framework library used by Firefox and Thunderbird for video playback on Linux. The root cause is improper bounds checking in the H.264 video decoder when processing crafted video frames within m4v (MPEG-4 Video) container files. GStreamer (CPE: cpe:2.3:a:gstreamer:gstreamer) is leveraged by Mozilla Firefox (cpe:2.3:a:mozilla:firefox), Firefox ESR (cpe:2.3:a:mozilla:firefox), Thunderbird (cpe:2.3:a:mozilla:thunderbird), and SeaMonkey (cpe:2.3:a:mozilla:seamonkey) for native video codec support. The vulnerability allows reading beyond allocated buffer boundaries, which can expose sensitive memory contents or be chained with other flaws to achieve code execution. While no specific CWE is listed in the CVE record, the technical indicators (buffer over-read, crafted input, memory disclosure potential) align with CWE-125 (Out-of-bounds Read).
Know when Gstreamer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:M/Au:N/C:P/I:P/A:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
GStreamer before 1.4.5, as used in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 on Linux, allows remote attackers to cause a denial of service (buffer over-read and application crash) or possibly execute arbitrary code via crafted H.264 video data in an m4v file.
Executive ViewAI
Organizations using Mozilla Firefox should be aware of notable risk from CVE-2015-0797 rated CVSS 6.8. Exploitation could compromise the security of affected deployments. A patch is available and should be applied during regular vulnerability management.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write an
A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to
A heap buffer over-read vulnerability exists in GStreamer's isomp4 plugin that allows reading past allocated memory boun
An integer overflow vulnerability in the GStreamer multimedia framework's matroska demuxer allows heap memory corruption
A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service o
A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denia
An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory
An integer overflow vulnerability in GStreamer's AVI demux element allows attackers to trigger a heap overwrite when par
A heap overflow vulnerability exists in GStreamer's matroskaparse element due to an integer overflow in the gst_matroska
GitHub PoC
Exploit-DB