PT-2017-19233 · Lame+2 · Lame+2

Agostino Sarubbo · Publicado 2017-06-25 · Atualizado 2019-10-03 · CVE-2017-9869

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions LAME version 3.99.5

Description The issue allows remote attackers to cause a denial of service, resulting in a buffer over-read and application crash, via a crafted audio file. This is due to a problem in the II step one function in layer2.c in mpglib, as used in libmpgdecoder.a.

Recommendations For LAME version 3.99.5, consider restricting the use of the II step one function in layer2.c until a patch is available. As a temporary workaround, avoid using libmpgdecoder.a with untrusted audio files to minimize the risk of exploitation.

Exploit

Correção

DoS

Out of bounds Read

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

ALT-PU-2018-1793

CVE-2017-9869

OPENSUSE-SU-2018:0543-1

OPENSUSE-SU-2018:0544-1

OPENSUSE-SU-2018_0544-1

Produtos afetados

Alt Linux

Lame

Suse

Referências · 38

• 🔥 https://exploit-db.com/exploits/42258 · Exploit
• https://suse.com/security/cve/CVE-2017-9869 · Nota
• https://suse.com/security/cve/CVE-2017-9411 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2018:0544-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-9869 · Aviso do Fabricante
• https://bugzilla.suse.com/1082397 · Nota
• https://suse.com/security/cve/CVE-2017-9410 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-9869 · Nota de Segurança
• https://suse.com/security/cve/CVE-2017-9870 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-9869 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2017-9869 · Nota de Segurança
• https://bugzilla.suse.com/1082317 · Nota
• https://bugzilla.suse.com/1082392 · Nota
• https://suse.com/security/cve/CVE-2017-9412 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2018:0543-1 · Aviso do Fabricante