PT-2008-1059 · Xiph.Org+1 · Libvorbis+1

Will Drewry · Published 2008-05-14 · Updated 2024-06-15 · CVE-2008-1419

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libvorbis versions 1.0rc2 through 1.2.0 libvorbis-devel version 1.0rc2

Description The issue affects the libvorbis package, allowing remote attackers to exploit multiple vulnerabilities, potentially leading to a denial of service, integer overflow, or disruption of confidentiality, integrity, and availability of protected information. The vulnerability can be triggered by a zero value for codebook.dim, causing a crash or infinite loop.

Recommendations For libvorbis versions 1.0rc2 through 1.2.0, update to a version later than 1.2.0 to resolve the issue. For libvorbis-devel version 1.0rc2, update to a version later than 1.0rc2 to resolve the issue. As a temporary workaround, consider restricting access to the libvorbis package until a patch is available.

Exploit

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2015-06352

BDU:2015-06353

BDU:2015-09634

CVE-2008-1419

DSA-1591-1

OPENSUSE-SU-2024:11009-1

RHSA-2008:0270

RHSA-2008:0271

RHSA-2008_0270

Affected Products

Red Hat

Libvorbis

References · 47

• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=440700 · Exploit
• https://redhat.com/archives/fedora-package-announce/2008-May/msg00243.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2008-06/msg00001.html · Vendor Advisory
• http://debian.org/security/2008/dsa-1591 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11009-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2008:102 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2008-1419 · Vendor Advisory
• http://ubuntu.com/usn/USN-682-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06353 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2008-1419 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-1419 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06352 · Security Note
• http://security.gentoo.org/glsa/glsa-200806-09.xml · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09634 · Security Note
• https://redhat.com/archives/fedora-package-announce/2008-May/msg00256.html · Vendor Advisory