Security Vulnerabilities fixed in Firefox ESR 38.2

Description

Security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team used the Address Sanitizer tool to discover two buffer overflow issues in the Libvpx library used for WebM video when decoding a malformed WebM video file. These buffer overflows result in potentially exploitable crashes.

Affected Applications

Firefox ESR

CVE References

CVE-2015-4486 CVE-2015-4485

Other References

https://www.mozilla.org/en-US/security/advisories/mfsa2015-89