PT-2017-13878 · Xiph.Org+1 · Libvorbis+1

Published 2017-10-09 · Updated 2017-11-05 · CVE-2017-15185

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Libmp3splt version 0.9.2

Description The issue allows remote attackers to cause a denial of service, resulting in an application crash, by providing a crafted file containing invalid input. This is due to the vorbis block clear function from the libvorbis library being called with uninitialized data in the plugins/ogg.c file of Libmp3splt.

Recommendations For Libmp3splt version 0.9.2, as a temporary workaround, consider avoiding the use of crafted files that may trigger the denial of service until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2017-15185

Affected Products

Libmp3Splt

Libvorbis

References · 11

• 🔥 https://exploit-db.com/exploits/42399 · Exploit
• https://osv.dev/vulnerability/CVE-2017-15185 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-15185 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-15185 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-15185 · Security Note
• https://cve.org/CVERecord?id=CVE-2017-15185 · Security Note
• https://ubuntu.com/security/CVE-2017-15185 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-15185 · Vendor Advisory
• http://seclists.org/fulldisclosure/2017/Jul/82 · Note
• https://anonscm.debian.org/cgit/users/ron/mp3splt.git/commit/?id=18f018cd774cb931116ce06a520dc0c5f9443932 · Note
• https://lists.debian.org/debian-lts/2017/09/msg00115.html · Note