PT-2017-19233 · Lame+2 · Lame+2

Agostino Sarubbo · Published 2017-06-25 · Updated 2019-10-03 · CVE-2017-9869

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions LAME version 3.99.5

Description The issue allows remote attackers to cause a denial of service, resulting in a buffer over-read and application crash, via a crafted audio file. This is due to a problem in the II step one function in layer2.c in mpglib, as used in libmpgdecoder.a.

Recommendations For LAME version 3.99.5, consider restricting the use of the II step one function in layer2.c until a patch is available. As a temporary workaround, avoid using libmpgdecoder.a with untrusted audio files to minimize the risk of exploitation.

Exploit

Fix

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2018-1793

CVE-2017-9869

OPENSUSE-SU-2018:0543-1

OPENSUSE-SU-2018:0544-1

OPENSUSE-SU-2018_0544-1

Affected Products

Alt Linux

Lame

Suse

References · 38

• 🔥 https://exploit-db.com/exploits/42258 · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2018:0544-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-9869 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-9869 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-9869 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-9869 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2018:0543-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-9869 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-9869 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-9869 · Vendor Advisory
• https://suse.com/security/cve/CVE-2017-9869 · Note
• https://suse.com/security/cve/CVE-2017-9411 · Note
• https://bugzilla.suse.com/1082397 · Note
• https://suse.com/security/cve/CVE-2017-9410 · Note
• https://suse.com/security/cve/CVE-2017-9870 · Note