CVE-2008-2009 Xiph.org libvorbis before 1.0 does not properly check for underpopulated Huffman trees, which allows remote attackers to cause a denial of service (crash) via a crafted OGG file that triggers memory c...
MediumCVSS 4.3
EPSS 3.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Xiph.org libvorbis before 1.0 does not properly check for underpopulated Huffman trees, which allows remote attackers to cause a denial of service (crash) via a crafted OGG file that triggers memory corruption during execution of the _make_decode_tree function.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| xiph.org libvorbis | = 1.0-beta4 | No fix listed |
| xiph.org libvorbis | = 1.0-rc1 | No fix listed |
| xiph.org libvorbis | = 1.0-rc2 | No fix listed |
| Canonical Ubuntu Linux | = 8.04 | No fix listed |
| Canonical Ubuntu Linux | = 8.10 | No fix listed |
| Canonical Ubuntu Linux | = 9.04 | No fix listed |
| Canonical Ubuntu Linux | = 9.10 | No fix listed |
| debian/libvorbis(Debian:12) | < 1.2.0.dfsg-4 | 1.2.0.dfsg-4 |
| debian/libvorbis(Debian:13) | < 1.2.0.dfsg-4 | 1.2.0.dfsg-4 |
| debian/libvorbis(Debian:14) | < 1.2.0.dfsg-4 | 1.2.0.dfsg-4 |
| debian/libvorbisidec(Debian:12) | < 1.0.2+svn18153-0.1 | 1.0.2+svn18153-0.1 |
| debian/libvorbisidec(Debian:13) | < 1.0.2+svn18153-0.1 | 1.0.2+svn18153-0.1 |
| debian/libvorbisidec(Debian:14) | < 1.0.2+svn18153-0.1 | 1.0.2+svn18153-0.1 |
References
- 30247 third-party-advisory
- RHSA-2008:0271 third-party-advisory vendor-advisory
- 1020029 third-party-advisory vdb-entry
- USN-861-1 third-party-advisory vendor-advisory
- ADV-2008-1510 third-party-advisory vdb-entry
- bugzilla.redhat.com issue-tracking third-party-advisory
- libvorbis-makedecodetree-dos(42521) third-party-advisory vdb-entry
- Debian Security Tracker CVE-2008-2009 vendor-advisory
- bugs.debian.org issue-tracking
- bugs.debian.org issue-tracking