CVE-2017-15185 plugins/ogg.c in Libmp3splt 0.9.2 calls the libvorbis vorbis_block_clear function with uninitialized data upon detection of invalid input, which allows remote attackers to cause a denial of service (a...
MediumCVSS 5.0
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
plugins/ogg.c in Libmp3splt 0.9.2 calls the libvorbis vorbis_block_clear function with uninitialized data upon detection of invalid input, which allows remote attackers to cause a denial of service (application crash) via a crafted file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/mp3splt(Debian:12) | < 2.6.2+20170630-2 | 2.6.2+20170630-2 |
| debian/mp3splt(Debian:13) | < 2.6.2+20170630-2 | 2.6.2+20170630-2 |
| debian/mp3splt(Debian:14) | < 2.6.2+20170630-2 | 2.6.2+20170630-2 |
| libmp3splt project libmp3splt | = 0.9.2 | No fix listed |
References
- Debian Security Tracker CVE-2017-15185 vendor-advisory
- seclists.org mailing-list not-applicable third-party-advisory
- anonscm.debian.org not-applicable third-party-advisory
- lists.debian.org third-party-advisory
- 42399 exploit not-applicable third-party-advisory vdb-entry