PT-2008-1134 · Underbit Technologies+1 · Libid3Tag+1

Kentaro Oda · Published 2008-05-07 · Updated 2023-02-13 · CVE-2008-2109

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions libid3tag versions 0.15.0b through 0.15.1b-r1 libid3tag version 0.15.1b-r2 is not affected, so the range is up to 0.15.1b-r1

Description The issue allows context-dependent attackers to cause a denial of service, specifically CPU consumption, via an ID3 FIELD TYPE STRINGLIST field that ends in '0', triggering an infinite loop. Exploitation of this issue can lead to disruption of protected information and can be carried out remotely.

Recommendations For libid3tag versions 0.15.0b through 0.15.1b-r1, update to version 0.15.1b-r2 or later to resolve the issue. As a temporary workaround, consider restricting the processing of ID3 fields that end in '0' to prevent infinite loops until a patch is applied.

Exploit

Fix

Related Identifiers

BDU:2015-09643

CVE-2008-2109

MGASA-2018-0223

OPENSUSE-SU-2024:10454-1

SUSE-SU-2018:0715-1

SUSE-SU-2018:0722-1

Affected Products

Suse

Libid3Tag

References · 30

• 🔥 http://mars.org/mailman/public/mad-dev/2008-January/001366.html · Exploit
• https://security-tracker.debian.org/tracker/CVE-2008-2109 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200805-15.xml · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0223.html · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2018:0715-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09643 · Security Note
• http://bugs.gentoo.org/show_bug.cgi?id=210564 · Patch
• https://osv.dev/vulnerability/CVE-2008-2109 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2008:103 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-2109 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2018:0722-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2018-0223 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-2109 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-May/msg00159.html · Vendor Advisory
• https://suse.com/security/cve/CVE-2017-11551 · Note