CVE-2015-4486 is a critical vulnerability in the libvpx library used by Mozilla Firefox (versions before 40.0 and ESR 38.x before 38.2), as well as products from Canonical, OpenSUSE, and Oracle. It allows remote attackers to execute arbitrary code or cause a denial of service through an out-of-bounds read when processing malformed WebM video data. With a CVSS score of 10.0, this vulnerability is easily exploitable over the network without authentication, leading to complete compromise of confidentiality, integrity, and availability. While there are no known public exploits or Metasploit modules, the vulnerability received some community discussion and media coverage at the time, indicating awareness.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
12.04CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:* | ||
14.04CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* | ||
15.04CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:* | ||
13.1CPE matchmatch criteria | cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:* | ||
13.2CPE matchmatch criteria | cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:L/Au:N/C:C/I:C/A:C
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.