CVE-2014-9639 Integer overflow in oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (crash) via a crafted number of channels in a WAV file, which triggers an out-of-bounds memory acc...
MediumCVSS 5.0
EPSS 3.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Integer overflow in oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (crash) via a crafted number of channels in a WAV file, which triggers an out-of-bounds memory access.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/opus-tools(Debian:12) | < 0.1.10-1 | 0.1.10-1 |
| debian/opus-tools(Debian:13) | < 0.1.10-1 | 0.1.10-1 |
| debian/opus-tools(Debian:14) | < 0.1.10-1 | 0.1.10-1 |
| debian/vorbis-tools(Debian:12) | < 1.4.0-7 | 1.4.0-7 |
| debian/vorbis-tools(Debian:13) | < 1.4.0-7 | 1.4.0-7 |
| debian/vorbis-tools(Debian:14) | < 1.4.0-7 | 1.4.0-7 |
| xiph vorbis-tools | = 1.4.0 | No fix listed |
| fedoraproject fedora | = 20 | No fix listed |
| fedoraproject fedora | = 21 | No fix listed |
| opensuse | = 13.1 | No fix listed |
| opensuse | = 13.2 | No fix listed |
References
- Debian Security Tracker CVE-2014-9639 vendor-advisory
- FEDORA-2015-2335 vendor-advisory
- FEDORA-2015-2330 vendor-advisory
- openSUSE-SU-2015:0522 vendor-advisory
- 20150119 vorbis-tools issues mailing-list
- [oss-security] 20150121 CVE request: two issues in vorbis-tools mailing-list
- [oss-security] 20150122 Re: CVE request: two issues in vorbis-tools mailing-list
- 72295 vdb-entry
- trac.xiph.org exploit
- bugs.debian.org issue-tracking
- bugs.debian.org issue-tracking