CVE-2015-4475

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 40.0 Firefox ESR versions prior to 38.2

Description The issue is related to the mozilla::AudioSink function mishandling inconsistent sample formats within MP3 audio data. This can be exploited by remote attackers via a malformed file, potentially leading to arbitrary code execution or a denial of service (out-of-bounds read). The vulnerability is also described as a buffer overflow.

Recommendations For Mozilla Firefox versions prior to 40.0, update to version 40.0 or later. For Firefox ESR versions prior to 38.2, update to version 38.2 or later.