CVE-2015-4493

Heap-based buffer overflow in the stagefright::ESDS::parseESDescriptor function in libstagefright in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code via an invalid size field in an esds chunk in MPEG-4 video data, a related issue to CVE-2015-1539.

• CWE-119

• http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00015.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-updates/2015-08/msg00030.html
• http://lists.opensuse.org/opensuse-updates/2015-08/msg00031.html
• http://rhn.redhat.com/errata/RHSA-2015-1586.html
• http://www.debian.org/security/2015/dsa-3333
• http://www.mozilla.org/security/announce/2015/mfsa2015-83.htmlVendor Advisory
• http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlThird Party Advisory
• http://www.securitytracker.com/id/1033247
• http://www.ubuntu.com/usn/USN-2702-1Third Party Advisory
• http://www.ubuntu.com/usn/USN-2702-2Third Party Advisory
• http://www.ubuntu.com/usn/USN-2702-3
• https://bugzilla.mozilla.org/show_bug.cgi?id=1186718Issue Tracking
• https://hg.mozilla.org/mozilla-central/rev/a674c7019cb5
• https://security.gentoo.org/glsa/201605-06
• http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00015.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-updates/2015-08/msg00030.html
• http://lists.opensuse.org/opensuse-updates/2015-08/msg00031.html
• http://rhn.redhat.com/errata/RHSA-2015-1586.html
• http://www.debian.org/security/2015/dsa-3333
• http://www.mozilla.org/security/announce/2015/mfsa2015-83.htmlVendor Advisory
• http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlThird Party Advisory
• http://www.securitytracker.com/id/1033247
• http://www.ubuntu.com/usn/USN-2702-1Third Party Advisory
• http://www.ubuntu.com/usn/USN-2702-2Third Party Advisory
• http://www.ubuntu.com/usn/USN-2702-3
• https://bugzilla.mozilla.org/show_bug.cgi?id=1186718Issue Tracking
• https://hg.mozilla.org/mozilla-central/rev/a674c7019cb5
• https://security.gentoo.org/glsa/201605-06

Published

Aug 16, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-4487The nsTSubstring::ReplacePrep function in Mozilla Firefox be…
• CVE-2015-4488Use-after-free vulnerability in the StyleAnimationValue clas…
• CVE-2015-4489The nsTArray_Impl class in Mozilla Firefox before 40.0, Fire…
• CVE-2015-4490The nsCSPHostSrc::permits function in dom/security/nsCSPUtil…
• CVE-2015-4491Integer overflow in the make_filter_table function in pixops…
• CVE-2015-4492Use-after-free vulnerability in the XMLHttpRequest::Open imp…
• CVE-2015-4494Mozilla Firefox OS before 2.2 does not require the wifi-mana…
• CVE-2015-4495The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR…8.8
• CVE-2015-4496Multiple integer overflows in libstagefright in Mozilla Fire…
• CVE-2015-4497Use-after-free vulnerability in the CanvasRenderingContext2D…
• CVE-2015-4498The add-on installation feature in Mozilla Firefox before 40…
• CVE-2015-4499Util.pm in Bugzilla 2.x, 3.x, and 4.x before 4.2.15, 4.3.x a…