Description
Multiple integer overflows in libstagefright in Mozilla Firefox before 38.0 allow remote attackers to execute arbitrary code via crafted sample metadata in an MPEG-4 video file, a related issue to CVE-2015-1538.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | firefox | 40.0+build4-0ubuntu0.14.04.4 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | firefox | 38.0-3.el7_1 | RHSA-2015:0988 |
| RHEL 6 | firefox | 38.0-4.el6_6 | RHSA-2015:0988 |
| RHEL 5 | firefox | 38.0-4.el5_11 | RHSA-2015:0988 |
Advisories 1
- RHSA-2015:0988 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Aug 1, 2026