PT-2020-15266 · Xiph.Org+2 · Libvorbis+2

Blbiop · Published 2018-06-06 · Updated 2023-03-27 · CVE-2020-20412

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libvorbis versions prior to 1.3.6 StepMania version 5.0.12

Description The issue is related to insufficient array bounds checking in libvorbis, which can be exploited via a crafted OGG file. This affects products using libvorbis, including StepMania.

Recommendations For libvorbis versions prior to 1.3.6, update to version 1.3.6 or later to resolve the issue. For StepMania version 5.0.12, consider updating to a version that uses an updated libvorbis library, or apply any available patches from the vendor.

Exploit

Fix

Improper Validation of Array Index

Weakness Enumeration

CWE-129

Related Identifiers

ALT-PU-2018-1863

CVE-2020-20412

Affected Products

Alt Linux

Stepmania

Libvorbis

References · 5

• 🔥 https://github.com/stepmania/stepmania/issues/1890 · Exploit
• https://osv.dev/vulnerability/CVE-2020-20412 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-20412 · Security Note
• https://t.me/cvenotify/42304 · Telegram Post
• https://t.me/cibsecurity/21309 · Telegram Post