CVE-2014-9638 oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (divide-by-zero error and crash) via a WAV file with the number of channels set to zero.
MediumCVSS 5.0
EPSS 3.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (divide-by-zero error and crash) via a WAV file with the number of channels set to zero.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/opus-tools(Debian:12) | < 0.1.10-1 | 0.1.10-1 |
| debian/opus-tools(Debian:13) | < 0.1.10-1 | 0.1.10-1 |
| debian/opus-tools(Debian:14) | < 0.1.10-1 | 0.1.10-1 |
| debian/vorbis-tools(Debian:12) | < 1.4.0-7 | 1.4.0-7 |
| debian/vorbis-tools(Debian:13) | < 1.4.0-7 | 1.4.0-7 |
| debian/vorbis-tools(Debian:14) | < 1.4.0-7 | 1.4.0-7 |
| fedoraproject fedora | = 20 | No fix listed |
| fedoraproject fedora | = 21 | No fix listed |
| opensuse | = 13.1 | No fix listed |
| opensuse | = 13.2 | No fix listed |
| xiph vorbis-tools | = 1.4.0 | No fix listed |
References
- Debian Security Tracker CVE-2014-9638 vendor-advisory
- FEDORA-2015-2335 vendor-advisory
- FEDORA-2015-2330 vendor-advisory
- openSUSE-SU-2015:0522 vendor-advisory
- 20150119 vorbis-tools issues mailing-list
- [oss-security] 20150121 CVE request: two issues in vorbis-tools mailing-list
- [oss-security] 20150122 Re: CVE request: two issues in vorbis-tools mailing-list
- 72290 vdb-entry
- trac.xiph.org exploit
- bugs.debian.org issue-tracking
- bugs.debian.org issue-tracking