Red Hat Security AdvisoryRHSA-2008:0270
libvorbis security update
Released 2008-05-14 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Desktop version 3 libvorbis-1:1.0-10.el3, libvorbis-1:1.0-10.el3.i386, libvorbis-devel-1:1.0-10.el3 +1
- Red Hat Enterprise Linux (v. 5 server) libvorbis-1:1.1.2-3.el5_1.2, libvorbis-1:1.1.2-3.el5_1.2.i386, libvorbis-1:1.1.2-3.el5_1.2.ia64 +5
- Red Hat Enterprise Linux AS version 3 libvorbis-1:1.0-10.el3, libvorbis-1:1.0-10.el3.i386, libvorbis-1:1.0-10.el3.ia64 +5
- Red Hat Enterprise Linux AS version 4 libvorbis-1:1.1.0-3.el4_6.1, libvorbis-1:1.1.0-3.el4_6.1.i386, libvorbis-1:1.1.0-3.el4_6.1.ia64 +5
- Red Hat Enterprise Linux Desktop (v. 5 client) libvorbis-1:1.1.2-3.el5_1.2, libvorbis-1:1.1.2-3.el5_1.2.i386
- Red Hat Enterprise Linux Desktop Workstation (v. 5 client) libvorbis-1:1.1.2-3.el5_1.2, libvorbis-devel-1:1.1.2-3.el5_1.2, libvorbis-devel-1:1.1.2-3.el5_1.2.i386
- Red Hat Enterprise Linux Desktop version 4 libvorbis-1:1.1.0-3.el4_6.1, libvorbis-1:1.1.0-3.el4_6.1.i386, libvorbis-devel-1:1.1.0-3.el4_6.1 +1
- Red Hat Enterprise Linux ES version 3 libvorbis-1:1.0-10.el3, libvorbis-1:1.0-10.el3.i386, libvorbis-1:1.0-10.el3.ia64 +3
- Red Hat Enterprise Linux ES version 4 libvorbis-1:1.1.0-3.el4_6.1, libvorbis-1:1.1.0-3.el4_6.1.i386, libvorbis-1:1.1.0-3.el4_6.1.ia64 +3
- Red Hat Enterprise Linux WS version 3 libvorbis-1:1.0-10.el3, libvorbis-1:1.0-10.el3.i386, libvorbis-1:1.0-10.el3.ia64 +3
- Red Hat Enterprise Linux WS version 4 libvorbis-1:1.1.0-3.el4_6.1, libvorbis-1:1.1.0-3.el4_6.1.i386, libvorbis-1:1.1.0-3.el4_6.1.ia64 +3
Fixes 3 records
Priority MEDIUM 51
Integer overflow in a certain quantvals and quantlist calculation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted OGG file with…
CVSS 2.0HIGH 9.3· Network · No auth · Interaction — · EPSS 0.08126 · Published 2008-05-16 · Fixed CWE-189
Priority LOW 39
Integer overflow in residue partition value (aka partvals) evaluation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to execute arbitrary code via a crafted OGG file, which triggers a heap overflow.
CVSS 2.0MEDIUM 6.8· Network · No auth · Interaction — · EPSS 0.06321 · Published 2008-05-16 · Fixed CWE-189
Priority LOW 27
Xiph.org libvorbis 1.2.0 and earlier does not properly handle a zero value for codebook.dim, which allows remote attackers to cause a denial of service (crash or infinite loop) or trigger an integer overflow.
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.04254 · Published 2008-05-16 · Fixed CWE-20
THREATIST.IORead the docs