PT-2008-1060 · Xiph.Org+1 · Libvorbis+1

Will Drewry

·

Publicado

2008-05-14

·

Atualizado

2024-06-15

·

CVE-2008-1420

CVSS v2.0

9.3

Alta

VetorAV:N/AC:M/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions libvorbis versions prior to 1.2.1 rc1 libvorbis versions 1.0rc2 through 1.2.0
Description The issue is related to multiple vulnerabilities in the libvorbis package, which can be exploited remotely to compromise the confidentiality, integrity, and availability of protected information. Specifically, an integer overflow in residue partition value evaluation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to execute arbitrary code via a crafted OGG file, triggering a heap overflow.
Recommendations For libvorbis versions prior to 1.2.1 rc1, update to version 1.2.1 rc1 or later to resolve the issue. For libvorbis versions 1.0rc2 through 1.2.0, update to version 1.2.1 rc1 or later to resolve the issue. As a temporary workaround, consider restricting access to libvorbis until a patch is available.

Correção

RCE

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-20CWE-189

Identificadores relacionados

BDU:2015-06352
BDU:2015-06353
BDU:2015-09634
CVE-2008-1420
DSA-1591-1
OPENSUSE-SU-2024:10024-1
RHSA-2008:0270
RHSA-2008:0271
RHSA-2008_0270

Produtos afetados

Red Hat
Libvorbis