CVE-2008-1423

CVE-2008-1423 affects Xiph.org libvorbis up to version 1.2.0 and earlier, due to an integer overflow in a specific quantvals/quantlist calculation that can trigger a heap-based overflow when processing crafted OGG files with large virtual codebooks. This can lead to a crash or remote code executi...

CVE-2008-1420

Libvorbis (CVE-2008-1419, CVE-2008-1420, CVE-2008-1423) contains an integer overflow in residue partition value evaluation that can trigger a heap overflow and potentially allow remote code execution via a crafted OGG file. The issue was reported across multiple distributions (Ubuntu, SuSE, Mandr...

CVE-2008-1419

CVE-2008-1419 affects Xiph.org libvorbis 1.2.0 and earlier. A zero value for codebook.dim is not properly handled, allowing a remote attacker to cause a crash, infinite loop, or an integer overflow, potentially enabling code execution or Denial of Service when processing crafted OGG Vorbis stream...

CVE-2008-1420

Integer overflow in residue partition value aka partvals evaluation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to execute arbitrary code via a crafted OGG file, which triggers a heap overflow...

CVE-2008-2009

Xiph.org libvorbis before 1.0 does not properly check for underpopulated Huffman trees, which allows remote attackers to cause a denial of service crash via a crafted OGG file that triggers memory corruption during execution of the makedecodetree function...

CVE-2008-1423

Integer overflow in a certain quantvals and quantlist calculation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to cause a denial of service crash or execute arbitrary code via a crafted OGG file with a large virtual space for its codebook, which triggers a heap overflow...

CVE-2008-1419

Xiph.org libvorbis 1.2.0 and earlier does not properly handle a zero value for codebook.dim, which allows remote attackers to cause a denial of service crash or infinite loop or trigger an integer overflow...

CVE-2008-2009

CVE-2008-2009 affects libvorbis prior to 1.0, where underpopulated Huffman trees in OGG decoding can crash or memory-corrupt the process when processing a crafted OGG file. The issue arises during execution of _make_decode_tree and is tied to remote attack conditions. Multiple connected advisorie...

CVE-2008-1419

Xiph.org libvorbis 1.2.0 and earlier does not properly handle a zero value for codebook.dim, which allows remote attackers to cause a denial of service crash or infinite loop or trigger an integer overflow...

CVE-2008-1420

Integer overflow in residue partition value aka partvals evaluation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to execute arbitrary code via a crafted OGG file, which triggers a heap overflow...

CVE-2008-1423

Integer overflow in a certain quantvals and quantlist calculation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to cause a denial of service crash or execute arbitrary code via a crafted OGG file with a large virtual space for its codebook, which triggers a heap overflow...

CVE-2008-2009

Xiph.org libvorbis before 1.0 does not properly check for underpopulated Huffman trees, which allows remote attackers to cause a denial of service crash via a crafted OGG file that triggers memory corruption during execution of the makedecodetree function...

libvorbis security update

CentOS Errata and Security Advisory CESA-2008:0271-01 Updated libvorbis packages that fix various security issues are now available for Red Hat Enterprise Linux 2.1. This update has been rated as having important security impact by the Red Hat Security Response Team. The libvorbis packages contai...

Fedora 8 : libvorbis-1.2.0-2.fc8 (2008-3934)

Will Drewry of the Google Security Team reported several flaws in the way libvorbis processed audio data. An attacker could create a carefully crafted OGG audio file in such a way that it could cause an application linked with libvorbis to crash, or execute arbitrary code when it was opened...

CentOS 3 / 4 / 5 : libvorbis (CESA-2008:0270)

Updated libvorbis packages that fix various security issues are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The libvorbis packages contain runtime libraries for use in programs that...

CVE-2008-2009

Xiph.org libvorbis before 1.0 does not properly check for underpopulated Huffman trees, which allows remote attackers to cause a denial of service crash via a crafted OGG file that triggers memory corruption during execution of the makedecodetree function...

Fedora 9 : libvorbis-1.2.0-4.fc9 (2008-3910)

Will Drewry of the Google Security Team reported several flaws in the way libvorbis processed audio data. An attacker could create a carefully crafted OGG audio file in such a way that it could cause an application linked with libvorbis to crash, or execute arbitrary code when it was opened...

Fedora 7 : libvorbis-1.1.2-4.fc7 (2008-3898)

Will Drewry of the Google Security Team reported several flaws in the way libvorbis processed audio data. An attacker could create a carefully crafted OGG audio file in such a way that it could cause an application linked with libvorbis to crash, or execute arbitrary code when it was opened...

RHEL 4 / 5 : libvorbis (RHSA-2008:0270)

The remote Redhat Enterprise Linux 4 / 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2008:0270 advisory. The libvorbis packages contain runtime libraries for use in programs that support Ogg Vorbis. Ogg Vorbis is a fully open, non-proprietar...

RHEL 2.1 : libvorbis (RHSA-2008:0271)

Updated libvorbis packages that fix various security issues are now available for Red Hat Enterprise Linux 2.1. This update has been rated as having important security impact by the Red Hat Security Response Team. The libvorbis packages contain runtime libraries for use in programs that support O...