CVE-2008-2109 field.c in the libid3tag 0.15.0b library allows context-dependent attackers to cause a denial of service (CPU consumption) via an ID3_FIELD_TYPE_STRINGLIST field that ends in '\0', which triggers an i...
MediumCVSS 5.0
EPSS 7.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
field.c in the libid3tag 0.15.0b library allows context-dependent attackers to cause a denial of service (CPU consumption) via an ID3_FIELD_TYPE_STRINGLIST field that ends in '\0', which triggers an infinite loop.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| media-libs libid3tag | = 0.15.0b | No fix listed |
| debian/libid3tag(Debian:12) | < 0.15.1b-8 | 0.15.1b-8 |
| debian/libid3tag(Debian:13) | < 0.15.1b-8 | 0.15.1b-8 |
| debian/libid3tag(Debian:14) | < 0.15.1b-8 | 0.15.1b-8 |
References
- bugs.gentoo.org patch
- 30173 third-party-advisory
- 30182 third-party-advisory
- GLSA-200805-15 vendor-advisory
- MDVSA-2008:103 vendor-advisory
- [mad-dev] 20080112 Initite loop bug in libid3tag-0.15.0b exploit mailing-list
- 29210 vdb-entry
- libid3tag-field-dos(42271) vdb-entry
- FEDORA-2008-3757 vendor-advisory
- Debian Security Tracker CVE-2008-2109 vendor-advisory
- bugs.debian.org issue-tracking