MEDIUM5.3
Уязвимость функции aiff_open (oggenc/audio.c) пакета vorbis-tools, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 3.xСРЕДНЯЯ 5.3
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LCVSS 2.0СРЕДНЯЯ 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:P
ALT-PU-2023-1433-1Обновление пакета vorbis-tools в ветке c9f2
Серьёзность:
Закрытые проблемы (6)
MEDIUM5.0
oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (divide-by-zero error and crash) via a WAV file with the number of channels set to zero.
CVSS 2.0СРЕДНЯЯ 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:PСсылки
- http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150543.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150570.html
- http://lists.opensuse.org/opensuse-updates/2015-03/msg00054.html
- http://seclists.org/fulldisclosure/2015/Jan/78
- http://www.openwall.com/lists/oss-security/2015/01/21/5
- http://www.openwall.com/lists/oss-security/2015/01/22/9
- http://www.securityfocus.com/bid/72290
- https://trac.xiph.org/ticket/2137
- http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150543.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150570.html
- http://lists.opensuse.org/opensuse-updates/2015-03/msg00054.html
- http://seclists.org/fulldisclosure/2015/Jan/78
- http://www.openwall.com/lists/oss-security/2015/01/21/5
- http://www.openwall.com/lists/oss-security/2015/01/22/9
- http://www.securityfocus.com/bid/72290
- https://trac.xiph.org/ticket/2137
MEDIUM5.0
Integer overflow in oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (crash) via a crafted number of channels in a WAV file, which triggers an out-of-bounds memory access.
CVSS 2.0СРЕДНЯЯ 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:PСсылки
- http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150543.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150570.html
- http://lists.opensuse.org/opensuse-updates/2015-03/msg00054.html
- http://seclists.org/fulldisclosure/2015/Jan/78
- http://www.openwall.com/lists/oss-security/2015/01/21/5
- http://www.openwall.com/lists/oss-security/2015/01/22/9
- http://www.securityfocus.com/bid/72295
- https://trac.xiph.org/ticket/2136
- http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150543.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150570.html
- http://lists.opensuse.org/opensuse-updates/2015-03/msg00054.html
- http://seclists.org/fulldisclosure/2015/Jan/78
- http://www.openwall.com/lists/oss-security/2015/01/21/5
- http://www.openwall.com/lists/oss-security/2015/01/22/9
- http://www.securityfocus.com/bid/72295
- https://trac.xiph.org/ticket/2136
MEDIUM5.0
oggenc/oggenc.c in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted raw file.
CVSS 2.0СРЕДНЯЯ 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:PСсылки
- http://advisories.mageia.org/MGASA-2015-0051.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148852.html
- http://lists.opensuse.org/opensuse-updates/2015-02/msg00032.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:037
- http://www.openwall.com/lists/oss-security/2015/01/21/6
- http://www.openwall.com/lists/oss-security/2015/01/22/9
- https://trac.xiph.org/changeset/19117
- https://trac.xiph.org/ticket/2009
- http://advisories.mageia.org/MGASA-2015-0051.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148852.html
- http://lists.opensuse.org/opensuse-updates/2015-02/msg00032.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:037
- http://www.openwall.com/lists/oss-security/2015/01/21/6
- http://www.openwall.com/lists/oss-security/2015/01/22/9
- https://trac.xiph.org/changeset/19117
- https://trac.xiph.org/ticket/2009
MEDIUM4.3
Buffer overflow in the aiff_open function in oggenc/audio.c in vorbis-tools 1.4.0 and earlier allows remote attackers to cause a denial of service (crash) via a crafted AIFF file.
CVSS 2.0СРЕДНЯЯ 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:PСсылки
- http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165555.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166424.html
- http://lists.opensuse.org/opensuse-updates/2015-10/msg00013.html
- http://seclists.org/oss-sec/2015/q3/455
- http://seclists.org/oss-sec/2015/q3/457
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=797461
- https://bugzilla.redhat.com/show_bug.cgi?id=1258424
- https://bugzilla.redhat.com/show_bug.cgi?id=1258443
- https://trac.xiph.org/attachment/ticket/2212/0001-oggenc-Fix-large-alloca-on-bad-AIFF-input.patch
- https://trac.xiph.org/ticket/2212
- http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165555.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166424.html
- http://lists.opensuse.org/opensuse-updates/2015-10/msg00013.html
- http://seclists.org/oss-sec/2015/q3/455
- http://seclists.org/oss-sec/2015/q3/457
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=797461
- https://bugzilla.redhat.com/show_bug.cgi?id=1258424
- https://bugzilla.redhat.com/show_bug.cgi?id=1258443
- https://trac.xiph.org/attachment/ticket/2212/0001-oggenc-Fix-large-alloca-on-bad-AIFF-input.patch
- https://trac.xiph.org/ticket/2212
MEDIUM5.5
The wav_open function in oggenc/audio.c in Xiph.Org vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (memory allocation error) via a crafted wav file.
CVSS 2.0СРЕДНЯЯ 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 5.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H