Description
liboggplay in Mozilla Firefox 3.5.x before 3.5.6 and SeaMonkey before 2.0.1 might allow context-dependent attackers to cause a denial of service (application crash) or execute arbitrary code via unspecified vectors, related to "memory safety issues."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | liboggplay | 0.2.1~git20091227-1.1 | — |
| Debian 12 | liboggplay | 0.2.1~git20091227-1.1 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | MozillaFirefox | 50.1.0-1.1 | openSUSE-SU-2024:10071-1 |
| openSUSE Tumbleweed | firefox-esr | 128.5.1-1.1 | openSUSE-SU-2024:14572-1 |
Advisories 2
- openSUSE-SU-2024:14572-1 firefox-esr-128.5.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10071-1 MozillaFirefox-50.1.0-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- 37699 third-party-advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=504843
- 1023335 vdb-entry
- 1023336 vdb-entry
- ADV-2009-3547 vdb-entry
- mozilla-liboggplay-code-execution(54804) vdb-entry
- 37881 third-party-advisory
- FEDORA-2009-13362 vendor-advisory
- 37785 third-party-advisory
- USN-874-1 vendor-advisory
- FEDORA-2009-13333 vendor-advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=523816
- oval:org.mitre.oval:def:8009 vdb-entry signature
- 37349 vdb-entry
- FEDORA-2009-13366 vendor-advisory
- 37856 third-party-advisory
- http://www.mozilla.org/security/announce/2009/mfsa2009-66.html
- 37369 vdb-entry
- SUSE-SA:2009:063 vendor-advisory