PT-2017-7547 · Lame+3 · Lame+3

Brian Carpenter · Published 2017-06-25 · Updated 2022-08-29 · CVE-2015-9100

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions LAME version 3.99.5

Description The issue allows remote attackers to cause a denial of service, resulting in a NULL pointer dereference and application crash, via a crafted audio file. This is due to a problem in the fill buffer resample function in util.c in libmp3lame.a.

Recommendations For LAME version 3.99.5, consider avoiding the use of crafted audio files that could trigger the denial of service until a patch is available. As a temporary workaround, restrict the processing of untrusted audio files to minimize the risk of application crash.

Exploit

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALT-PU-2018-1793

CVE-2015-9100

OPENSUSE-SU-2018:0543-1

OPENSUSE-SU-2018:0544-1

OPENSUSE-SU-2018_0544-1

USN-4780-1

Affected Products

Alt Linux

Lame

Suse

Ubuntu

References · 94

• 🔥 https://github.com/Hack-Me/Pocs_for_Multi_Versions/tree/main/CVE-2015-9101 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9099 · Security Note
• https://ubuntu.com/security/CVE-2015-9101 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9412 · Security Note
• https://ubuntu.com/security/CVE-2017-8419 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9410 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15019 · Security Note
• https://ubuntu.com/security/CVE-2017-15019 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-9100 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9101 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2018:0544-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-9100 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2015-9100 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2015-9100 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9870 · Security Note