PT-2008-1060 · Xiph.Org+1 · Libvorbis+1
Will Drewry
·
Published
2008-05-14
·
Updated
2024-06-15
·
CVE-2008-1420
CVSS v2.0
9.3
High
| Vector | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
libvorbis versions prior to 1.2.1 rc1
libvorbis versions 1.0rc2 through 1.2.0
Description
The issue is related to multiple vulnerabilities in the libvorbis package, which can be exploited remotely to compromise the confidentiality, integrity, and availability of protected information. Specifically, an integer overflow in residue partition value evaluation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to execute arbitrary code via a crafted OGG file, triggering a heap overflow.
Recommendations
For libvorbis versions prior to 1.2.1 rc1, update to version 1.2.1 rc1 or later to resolve the issue.
For libvorbis versions 1.0rc2 through 1.2.0, update to version 1.2.1 rc1 or later to resolve the issue.
As a temporary workaround, consider restricting access to libvorbis until a patch is available.
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Red Hat
Libvorbis