PT-2009-6686 · Xiph.Org+1 · Libvorbis0A+5

Jan Lieskovsky · Published 1970-01-01 · Updated 2018-10-03 · CVE-2009-2663

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libvorbis before r16182 libvorbis0a (affected versions not specified) libvorbisfile3 (affected versions not specified) libvorbis-dev (affected versions not specified) libvorbisenc2 (affected versions not specified)

Description The issue concerns multiple vulnerabilities in the libvorbis package, which can lead to a disruption of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely, potentially causing a denial of service or allowing the execution of arbitrary code via a crafted .ogg file.

Recommendations For libvorbis before r16182, update to a version after r16182 to resolve the issue. For libvorbis0a, libvorbisfile3, libvorbis-dev, and libvorbisenc2, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-399

Related Identifiers

BDU:2015-02642

BDU:2015-02643

BDU:2015-02644

BDU:2015-02645

CVE-2009-2663

DSA-1939-1

RHSA-2009:1219

RHSA-2009_1219

Affected Products

Red Hat

Libvorbis

Libvorbis-Dev

Libvorbis0A

Libvorbisenc2

Libvorbisfile3

References · 32

• http://mozilla.org/security/announce/2009/mfsa2009-45.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2009-2663 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3379 · Security Note
• http://vupen.com/english/advisories/2009/2142 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-02644 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2009-2663 · Security Note
• https://usn.ubuntu.com/825-1 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2009-August/msg00198.html · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2009-August/msg00481.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-02645 · Security Note
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-266148-1 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2009-August/msg00261.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-2663 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2663 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html · Vendor Advisory