FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

libvpx -- out-of-bounds write

Affected packages
	libvpx	<	1.4.0
	firefox	<	33.0,1
	firefox-esr	<	31.1.2,1
	linux-firefox	<	33.0,1
	linux-seamonkey	<	2.30
	linux-thunderbird	<	31.1.2
	seamonkey	<	2.30
	thunderbird	<	31.1.2
	libxul	<	31.1.2

Details

VuXML ID	42c98cef-62b1-4b8b-9065-f4621e08d526
Discovery	2014-10-14
Entry	2015-08-12

The Mozilla Project reports:

Using the Address Sanitizer tool, security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team found an out-of-bounds write when buffering WebM format video containing frames with invalid tile sizes. This can lead to a potentially exploitable crash during WebM video playback.

[source]

References

CVE Name	CVE-2014-1578
URL	https://hg.mozilla.org/releases/mozilla-esr31/rev/6023f0b4f8ba
URL	https://www.mozilla.org/security/advisories/mfsa2014-77/