CVE-2015-6749 Buffer overflow in the aiff_open function in oggenc/audio.c in vorbis-tools 1.4.0 and earlier allows remote attackers to cause a denial of service (crash) via a crafted AIFF file.
MediumCVSS 4.3
EPSS 4.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Buffer overflow in the aiff_open function in oggenc/audio.c in vorbis-tools 1.4.0 and earlier allows remote attackers to cause a denial of service (crash) via a crafted AIFF file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/vorbis-tools(Debian:12) | < 1.4.0-7 | 1.4.0-7 |
| debian/vorbis-tools(Debian:13) | < 1.4.0-7 | 1.4.0-7 |
| debian/vorbis-tools(Debian:14) | < 1.4.0-7 | 1.4.0-7 |
| xiph vorbis-tools | <= 1.4.0 | No fix listed |
References
- Debian Security Tracker CVE-2015-6749 vendor-advisory
- FEDORA-2015-14664 vendor-advisory
- FEDORA-2015-14663 vendor-advisory
- openSUSE-SU-2015:1686 vendor-advisory
- [oss-security] 20150828 CVE request: vorbis-tools: buffer overflow in aiff_open() mailing-list
- [oss-security] 20150830 Re: CVE request: vorbis-tools: buffer overflow in aiff_open() mailing-list
- bugs.debian.org
- bugzilla.redhat.com
- bugzilla.redhat.com
- trac.xiph.org
- trac.xiph.org exploit
- bugs.debian.org issue-tracking