PT-2008-6941 · Xiph.Org+2 · Speex+3
Tomas Hoger
·
Publicado
1970-01-01
·
Atualizado
2024-06-15
·
CVE-2008-1686
CVSS v2.0
9.3
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Speex versions 1.1.12 and earlier
libfishsound versions 0.9.0 and earlier
xine-lib versions prior to 1.1.12
Description
The issue allows remote attackers to execute arbitrary code via a header structure containing a negative offset, which is used to dereference a function pointer. This can lead to a violation of confidentiality, integrity, and availability of protected information. The exploitation of this issue can be done remotely.
Recommendations
For Speex versions 1.1.12 and earlier, update to a version later than 1.1.12.
For libfishsound versions 0.9.0 and earlier, update to a version later than 0.9.0.
For xine-lib versions prior to 1.1.12, update to version 1.1.12 or later.
As a temporary workaround, consider restricting access to the vulnerable components until a patch is available.
Correção
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Red Hat
Speex
Libfishsound
Xine-Lib