PT-2018-4015 · Underbit Technologies+2 · Libid3Tag+2
Mark
·
Published
2018-02-20
·
Updated
2024-02-03
·
CVE-2004-2779
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
libid3tag versions 0.15.1b and earlier
Description
The issue arises from the
id3 utf16 deserialize() function in utf16.c, which misparses ID3v2 tags encoded in UTF-16 with an odd number of bytes. This triggers an endless loop that allocates memory until an out-of-memory (OOM) condition is reached, resulting in a denial-of-service (DoS).Recommendations
For libid3tag versions 0.15.1b and earlier, consider disabling the
id3 utf16 deserialize() function until a patch is available to prevent the denial-of-service condition.Fix
DoS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Suse
Libid3Tag