PT-2017-11933 · Xiph.Org+1 · Libvorbis+1

Qflb.Wu

·

Publicado

2017-07-31

·

Atualizado

2019-12-17

·

CVE-2017-11333

CVSS v3.1

5.5

Média

VetorAV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions libvorbis version 1.3.5
Description The issue allows remote attackers to cause a denial of service (OOM) via a crafted wav file. This is due to a problem in the vorbis analysis wrote function in lib/block.c.
Recommendations For libvorbis version 1.3.5, consider avoiding the use of the vorbis analysis wrote function until a patch is available. As a temporary workaround, restrict the processing of wav files from untrusted sources to minimize the risk of exploitation.

Exploit

Correção

DoS

NULL Pointer Dereference

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

ALT-PU-2018-1863
CVE-2017-11333
DLA-1368-1
DLA-2039-1
DSA-4113-1
MGASA-2019-0059
USN-3569-1

Produtos afetados

Alt Linux
Libvorbis