vorbis: integer oveflow caused by huge codebooks

Integer overflow in a certain quantvals and quantlist calculation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to cause a denial of service crash or execute arbitrary code via a crafted OGG file with a large virtual space for its codebook, which triggers a heap overflow...

vorbis: integer oveflow caused by huge codebooks

Integer overflow in a certain quantvals and quantlist calculation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to cause a denial of service crash or execute arbitrary code via a crafted OGG file with a large virtual space for its codebook, which triggers a heap overflow...

libvorbis -- various security issues

Red Hat reports: Will Drewry of the Google Security Team reported several flaws in the way libvorbis processed audio data. An attacker could create a carefully crafted Vorbis audio file in such a way that it could cause an application linked with libvorbis to crash, or execute arbitrary code when...

FreeBSD : vorbis-tools -- Speex header processing vulnerability (633716fa-1f8f-11dd-b143-0211d880e350)

Secunia reports : A vulnerability has been reported in vorbis-tools, which can potentially be exploited by malicious people to compromise a user's system. The vulnerability is caused due to an input validation error when processing Speex headers, which can be exploited via a specially crafted Spe...

Ubuntu 6.06 LTS / 7.04 / 7.10 / 8.04 LTS : vorbis-tools vulnerability (USN-611-2)

USN-611-1 fixed a vulnerability in Speex. This update provides the corresponding update for ogg123, part of vorbis-tools. It was discovered that Speex did not properly validate its input when processing Speex file headers. If a user or automated system were tricked into opening a specially crafte...

GLSA-200804-17 : Speex: User-assisted execution of arbitrary code

The remote host is affected by the vulnerability described in GLSA-200804-17 Speex: User-assisted execution of arbitrary code oCERT reported that the Speex library does not properly validate the 'mode' value it derives from Speex streams, allowing for array indexing vulnerabilities inside multipl...

Debian Security Advisory DSA 1538-1 (alsaplayer)

The remote host is missing an update to alsaplayer announced via advisory DSA 1538-1. OpenVAS Vulnerability Test $Id: deb15381.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1538-1 alsaplayer Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

vorbis-tools -- Speex header processing vulnerability

Secunia reports: A vulnerability has been reported in vorbis-tools, which can potentially be exploited by malicious people to compromise a user's system. The vulnerability is caused due to an input validation error when processing Speex headers, which can be exploited via a specially crafted Spee...

[oCERT-2008-004] multiple speex implementations insufficient boundary checks

2008/04/17 2008-004 multiple speex implementations insufficient boundary checks Description: The reference speex decoder from the Speex library performs insufficient boundary checks on a header structure read from user input, this has been reported in oCERT-2008-002 advisory. Further investigatio...

Alsaplayer < 0.99.80-rc3 Vorbis Input Local Buffer Overflow Exploit

No description provided by source. I have released this exploit for the alsaplayer bug CVE-2007-5301. You can find all the needed files at http://www.wekk.net/research/CVE-2007-5301/ With my modified version of vorbiscomment, you can generate a ogg exploit like this: whats@debian:$...

Debian DSA-1538-1 : alsaplayer - buffer overrun

Erik Sjolund discovered a buffer overflow vulnerability in the Ogg Vorbis input plugin of the alsaplayer audio playback application. Successful exploitation of this vulnerability through the opening of a maliciously crafted Vorbis file could lead to the execution of arbitrary code. %NASLMINLEVEL...

Alsaplayer < 0.99.80-rc3 Vorbis Input Local Buffer Overflow Exploit

Exploit for linux platform in category local exploits =================================================================== Alsaplayer 0.99.80-rc3 Vorbis Input Local Buffer Overflow Exploit =================================================================== I have released this exploit for the...

AlsaPlayer 0.99.80-rc3 - Vorbis Input Local Buffer Overflow

AlsaPlayer 0.99.80-rc3 - Vorbis Input Local Buffer Overflow I have released this exploit for the alsaplayer bug CVE-2007-5301. You can find all the needed files at http://www.wekk.net/research/CVE-2007-5301/ With my modified version of vorbiscomment, you can generate a ogg exploit like this:...

AlsaPlayer < 0.99.80-rc3 - Vorbis Input Local Buffer Overflow

I have released this exploit for the alsaplayer bug CVE-2007-5301. You can find all the needed files at http://www.wekk.net/research/CVE-2007-5301/ With my modified version of vorbiscomment, you can generate a ogg exploit like this: whats@debian:$ vorbiscomment.whats -w -t "TITLE=$perl -e 'print...

[SECURITY] [DSA 1538-1] New alsaplayer packages fix arbitrary code execution

------------------------------------------------------------------------ Debian Security Advisory DSA-1538-1 [email protected] http://www.debian.org/security/ Devin Carraway April 04, 2008 http://www.debian.org/security/faq -...

DSA-1538-1 alsaplayer - arbitrary code execution

Bulletin has no description...

libtremor -- multiple vulnerabilities

The RedHat Project reports: Will Drewry of the Google Security Team reported multiple issues in OGG Vorbis and Tremor libraries, that could cause application using those libraries to crash NULL pointer dereference or divide by zero, enter an infinite loop or cause heap overflow caused by integer...

DSA-1471-1 libvorbis - several vulnerabilities

Bulletin has no description...

Stack overflow

Multiple stack-based buffer overflows in the CPLIReadTagOGG function in CPIPlaylistItem.c in CoolPlayer 217 and earlier allow user-assisted remote attackers to execute arbitrary code via a long 1 cTag or 2 cValue field in an OGG Vorbis file...

CVE-2007-6609

Multiple stack-based buffer overflows in the CPLIReadTagOGG function in CPIPlaylistItem.c in CoolPlayer 217 and earlier allow user-assisted remote attackers to execute arbitrary code via a long 1 cTag or 2 cValue field in an OGG Vorbis file...