Every CVE Search/ Get API key

CVE-2015-0797

GStreamer before 1.4.5, as used in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and...

6.8 MediumFix available

GStreamer before 1.4.5, as used in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 on Linux, allows remote attackers to cause a denial of service (buffer over-read and application crash) or possibly execute arbitrary code via crafted H.264 video data in an m4v file.

Exploit likelihood

5.40%Down 1.2 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 6.8

GStreamer before 1.4.5, as used in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 on Linux, allows remote attackers to cause a denial of service (buffer over-read and application crash) or possibly execute arbitrary code via crafted H.264 video data in an m4v file.

Record
CVE-2015-0797
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Updated
2026-11-02
CVE List No score

GStreamer before 1.4.5, as used in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 on Linux, allows remote attackers to cause a denial of service (buffer over-read and application crash) or possibly execute arbitrary code via crafted H.264 video data in an m4v file.

Record
CVE-2015-0797
Updated
2026-11-02
EUVDEUVD-2015-0810 No score

GStreamer before 1.4.5, as used in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 on Linux, allows remote attackers to cause a denial of service (buffer over-read and application crash) or possibly execute arbitrary code via crafted H.264 video data in an m4v file.

Record
EUVD-2015-0810
Updated
2026-11-03
GitHub AdvisoriesGHSA-wvj4-9m85-jjv9 No score

GStreamer before 1.4.5, as used in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and...

GStreamer before 1.4.5, as used in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 on Linux, allows remote attackers to cause a denial of service (buffer over-read and application crash) or possibly execute arbitrary code via crafted H.264 video data in an m4v file.

Record
GHSA-wvj4-9m85-jjv9
Updated
2026-11-02
OSVMGASA-2015-0188 No score

Updated gstreamer0.10-plugins-bad packages fix security vulnerabilities

Updated gstreamer0.10-plugins-bad packages fix security vulnerability:

Aki Helin discovered a buffer overflow in the GStreamer plugin for MP4 playback, which could lead in the execution of arbitrary code (CVE-2015-0797).

Record
MGASA-2015-0188
Updated
2026-11-02
OSVopenSUSE-SU-2024:10429-1 No score

gstreamer-0_10-plugins-bad-0.10.23-22.4 on GA media

These are all security issues fixed in the gstreamer-0_10-plugins-bad-0.10.23-22.4 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10429-1
Updated
2026-11-02
Show 5 moreShow less
OSVSUSE-SU-2015:0921-1 No score

Security update for gstreamer-0_10-plugins-bad

gstreamer-0_10-plugins-bad was updated to fix a security issue, a buffer overflow in mp4 parsing (bnc#927559 CVE-2015-0797).

Security Issues:

* CVE-2015-0797
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0797>
Record
SUSE-SU-2015:0921-1
Updated
2026-11-02
OSVSUSE-SU-2015:0942-1 No score

Security update for gstreamer-0_10-plugins-bad

gstreamer-0_10-plugins-bad was updated to fix a security issue, a buffer overflow in mp4 parsing (bnc#927559 CVE-2015-0797).

Record
SUSE-SU-2015:0942-1
Updated
2026-11-02
OSVSUSE-SU-2015:0960-1 No score

Security update for MozillaFirefox

This update to Firefox 31.7.0 ESR (bsc#930622) fixes the following issues:

  • MFSA 2015-46/CVE-2015-2708/CVE-2015-2709 (bmo#1120655, bmo#1143299, bmo#1151139, bmo#1152177, bmo#1111251, bmo#1117977, bmo#1128064, bmo#1135066, bmo#1143194, bmo#1146101, bmo#1149526, bmo#1153688, bmo#1155474) Miscellaneous memory safety hazards (rv:38.0 / rv:31.7)
  • MFSA 2015-47/CVE-2015-0797 (bmo#1080995) Buffer overflow parsing H.264 video with Linux Gstreamer
  • MFSA 2015-48/CVE-2015-2710 (bmo#1149542) Buffer overflow with SVG content and CSS
  • MFSA 2015-51/CVE-2015-2713 (bmo#1153478) Use-after-free during text processing with vertical text enabled
  • MFSA 2015-54/CVE-2015-2716 (bmo#1140537) Buffer overflow when parsing compressed XML
Record
SUSE-SU-2015:0960-1
Updated
2026-11-02
OSVSUSE-SU-2015:0978-1 No score

Security update for MozillaFirefox

This update to Firefox 31.7.0 ESR fixes the following issues:

* 

  MFSA 2015-46 (CVE-2015-2708, CVE-2015-2709): Miscellaneous memory
  safety hazards (rv:38.0 / rv:31.7). Upstream references: bmo#1120655,
  bmo#1143299, bmo#1151139, bmo#1152177, bmo#1111251, bmo#1117977,
  bmo#1128064, bmo#1135066, bmo#1143194, bmo#1146101, bmo#1149526,
  bmo#1153688, bmo#1155474.

* 

  MFSA 2015-47 (CVE-2015-0797): Buffer overflow parsing H.264 video
  with Linux Gstreamer. Upstream references: bmo#1080995.

* 

  MFSA 2015-48 (CVE-2015-2710): Buffer overflow with SVG content and
  CSS. Upstream references: bmo#1149542.

* 

  MFSA 2015-51 (CVE-2015-2713): Use-after-free during text processing
  with vertical text enabled. Upstream references: bmo#1153478.

* 

  MFSA 2015-54 (CVE-2015-2716): Buffer overflow when parsing compressed
  XML. Upstream references: bmo#1140537.

Security Issues:

* CVE-2015-0797
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0797>
* CVE-2015-2708
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2708>
* CVE-2015-2709
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2709>
* CVE-2015-2710
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2710>
* CVE-2015-2713
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2713>
* CVE-2015-2716
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2716>
Record
SUSE-SU-2015:0978-1
Updated
2026-11-02
OSVUBUNTU-CVE-2015-0797 No score

GStreamer before 1.4.5, as used in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 on Linux, allows remote attackers to cause a denial of service (buffer over-read and application crash) or possibly execute arbitrary code via crafted H.264 video data in an m4v file.

Record
UBUNTU-CVE-2015-0797
Updated
2026-11-02

Affected products

Show 2 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
gst-plugins-bad0.10
Debian:8
From an advisory covering 4 CVEs
 before 0.10.23-7.4+deb8u3, plus listed versions
0.10.23-7.40.10.23-7.4+deb8u10.10.23-7.4+deb8u2
0.10.23-7.4+deb8u3
gst-plugins-bad0.10
Debian:7
 before 0.10.23-7.1+deb7u2, plus listed versions
0.10.23-7.10.10.23-7.1+deb7u1
0.10.23-7.1+deb7u2
iceweasel
Debian:7
From an advisory covering 6 CVEs
 before 31.7.0esr-1~deb7u1, plus listed versions
10.0.12esr-110.0.12esr-1+alpha10.0.12esr-1+nmu110.0.12esr-1+nmu1+alpha11.0-1
Show 45 moreShow less
11.0-211.0-311.0-411.0~b1-111.0~b1-211.0~b2-111.0~b3-111.0~b4-111.0~b5-111.0~b6-112.0-112.0-212.0-312.0-412.0-512.0-612.0-713.0-113.0.1-113.0.1-214.0.1-114.0.1-215.0-115.0.1-116.0-116.0.1-116.0.2-117.0-117.0.1-117.0.1-217.0.10esr-1~deb7u117.0.5esr-117.0.6esr-117.0.6esr-1~deb7u117.0.7esr-117.0.7esr-1~deb7u117.0.7esr-217.0.8esr-117.0.8esr-1~deb7u117.0.8esr-217.0.8esr-2~deb7u117.0.9esr-1~deb7u118.0-118.0.1-118.0.2-1
31.7.0esr-1~deb7u1
iceweasel
Debian:8
From an advisory covering 6 CVEs
 before 31.7.0esr-1~deb8u1, plus listed versions
31.6.0esr-131.7.0esr-1~deb7u1
31.7.0esr-1~deb8u1
icedove
Debian:7
From an advisory covering 5 CVEs
 before 31.7.0-1~deb7u1, plus listed versions
10.0.12-111.0-116.0.2-117.0-117.0.10-1
Show 45 moreShow less
17.0.10-1+powerpcspe117.0.10-1+powerpcspe217.0.10-1~deb7u117.0.2-117.0.4-117.0.5-117.0.5-217.0.7-117.0.7-1~deb7u117.0.8-117.0.8-1~deb7u117.0.9-117.0.9-1~deb7u117.0.9-224.0-124.0~b3-224.1.1-124.2.0-124.2.0-1+alpha24.2.0-1+powerpcspe124.3.0-124.3.0-224.4.0-124.4.0-1~deb7u124.5.0-124.5.0-1~deb7u124.5.0-224.6.0-1~deb7u124.7.0-1~deb7u124.8.0-1~deb7u124.8.1-1~deb7u130.0~b1-131.0-131.0-231.0-331.0~b1-231.0~b2-131.1.2-131.2.0-131.2.0-1~deb7u131.3.0-131.3.0-1+powerpcspe131.3.0-1~deb7u131.4.0-131.4.0-1~deb7u1
31.7.0-1~deb7u1
icedove
Debian:8
From an advisory covering 5 CVEs
 before 31.7.0-1~deb8u1, plus listed versions
31.6.0-131.7.0-1~deb7u1
31.7.0-1~deb8u1
gstreamer0.10-plugins-bad
Mageia:4
 before 0.10.23-14.1.mga4
0.10.23-14.1.mga4
gstreamer0.10-plugins-bad
Mageia:4
 before 0.10.23-14.1.mga4.tainted
0.10.23-14.1.mga4.tainted
firefox
Red Hat:enterprise_linux:5::client
From an advisory covering 6 CVEs
 before 0:38.0-4.el5_11
0:38.0-4.el5_11
firefox-debuginfo
Red Hat:enterprise_linux:5::client
From an advisory covering 6 CVEs
 before 0:38.0-4.el5_11
0:38.0-4.el5_11
Show 24 moreShow less
Affected packages
PackageAffectedFixed
firefox
Red Hat:enterprise_linux:5::server
From an advisory covering 6 CVEs
 before 0:38.0-4.el5_11
0:38.0-4.el5_11
firefox-debuginfo
Red Hat:enterprise_linux:5::server
From an advisory covering 6 CVEs
 before 0:38.0-4.el5_11
0:38.0-4.el5_11
firefox
Red Hat:enterprise_linux:6::client
From an advisory covering 6 CVEs
 before 0:38.0-4.el6_6
0:38.0-4.el6_6
firefox-debuginfo
Red Hat:enterprise_linux:6::client
From an advisory covering 6 CVEs
 before 0:38.0-4.el6_6
0:38.0-4.el6_6
firefox
Red Hat:enterprise_linux:6::computenode
From an advisory covering 6 CVEs
 before 0:38.0-4.el6_6
0:38.0-4.el6_6
firefox-debuginfo
Red Hat:enterprise_linux:6::computenode
From an advisory covering 6 CVEs
 before 0:38.0-4.el6_6
0:38.0-4.el6_6
firefox
Red Hat:enterprise_linux:6::server
From an advisory covering 6 CVEs
 before 0:38.0-4.el6_6
0:38.0-4.el6_6
firefox-debuginfo
Red Hat:enterprise_linux:6::server
From an advisory covering 6 CVEs
 before 0:38.0-4.el6_6
0:38.0-4.el6_6
firefox
Red Hat:enterprise_linux:6::workstation
From an advisory covering 6 CVEs
 before 0:38.0-4.el6_6
0:38.0-4.el6_6
firefox-debuginfo
Red Hat:enterprise_linux:6::workstation
From an advisory covering 6 CVEs
 before 0:38.0-4.el6_6
0:38.0-4.el6_6
firefox
Red Hat:enterprise_linux:7::client
From an advisory covering 6 CVEs
 before 0:38.0-3.el7_1
0:38.0-3.el7_1
firefox-debuginfo
Red Hat:enterprise_linux:7::client
From an advisory covering 6 CVEs
 before 0:38.0-3.el7_1
0:38.0-3.el7_1
firefox
Red Hat:enterprise_linux:7::server
From an advisory covering 6 CVEs
 before 0:38.0-3.el7_1
0:38.0-3.el7_1
firefox-debuginfo
Red Hat:enterprise_linux:7::server
From an advisory covering 6 CVEs
 before 0:38.0-3.el7_1
0:38.0-3.el7_1
firefox
Red Hat:enterprise_linux:7::workstation
From an advisory covering 6 CVEs
 before 0:38.0-3.el7_1
0:38.0-3.el7_1
firefox-debuginfo
Red Hat:enterprise_linux:7::workstation
From an advisory covering 6 CVEs
 before 0:38.0-3.el7_1
0:38.0-3.el7_1
gstreamer-0_10-plugins-bad
SUSE:Linux Enterprise Desktop 12
 before 0.10.23-17.1
0.10.23-17.1
gstreamer-0_10-plugins-bad
SUSE:Linux Enterprise Software Development Kit 12
 before 0.10.23-17.1
0.10.23-17.1
gstreamer-0_10-plugins-bad
SUSE:Linux Enterprise Workstation Extension 12
 before 0.10.23-17.1
0.10.23-17.1
MozillaFirefox
SUSE:Linux Enterprise Desktop 12
From an advisory covering 6 CVEs
 before 31.7.0esr-34.1
31.7.0esr-34.1
MozillaFirefox
SUSE:Linux Enterprise Software Development Kit 12
From an advisory covering 6 CVEs
 before 31.7.0esr-34.1
31.7.0esr-34.1
MozillaFirefox
SUSE:Linux Enterprise Server 12
From an advisory covering 6 CVEs
 before 31.7.0esr-34.1
31.7.0esr-34.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12
From an advisory covering 6 CVEs
 before 31.7.0esr-34.1
31.7.0esr-34.1
gst-plugins-bad0.10
Ubuntu:14.04:LTS
 before 0.10.23-7.2ubuntu1.1, plus listed versions
0.10.23-7ubuntu20.10.23-7.2ubuntu1
0.10.23-7.2ubuntu1.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-0797 is a medium vulnerability (CVSS 6.8) in Debian Linux, published April 15, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.40%, the 92nd percentile. Fixed in gst-plugins-bad0.10 0.10.23-7.1+deb7u2.

References

Show 57 moreShow less
This page doesn't list everything

Left out here: 78 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open