Fedora: Security Advisory (FEDORA-2024-faff3dd9d6)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 39 : vorbis-tools (2024-faff3dd9d6)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-faff3dd9d6 advisory. Security fix for CVE-2023-43361 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus h...

Fedora 38 : vorbis-tools (2024-5f8da7c1f1)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-5f8da7c1f1 advisory. Security fix for CVE-2023-43361 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus h...

Denial Of Service (DoS)

vorbis-tools is vulnerable to Denial Of Service DoS. The vulnerability exists due to the buffer overflow in the library, which allows an attacker to execute arbitrary code and cause a denial of service during the conversion of wav files to ogg files...

PT-2023-9143 · Unknown +2 · Stb Vorbis.C +2

Name of the Vulnerable Software and Affected Versions: stb vorbis.c version 1.22 Description: A heap-based buffer overflow vulnerability exists in the comment functionality of stb vorbis.c. A specially crafted .ogg file can lead to an out-of-bounds write. An attacker can provide a malicious file ...

Mageia: Security Advisory (MGASA-2023-0316)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MGASA-2023-0316 Updated vorbis-tools packages fix a security vulnerability

The upstream patch to fix CVE-2023-43361 was added...

Updated vorbis-tools packages fix a security vulnerability

The upstream patch to fix CVE-2023-43361 was added...

Fedora 39 : stb / usd (2023-def2f95af4)

The remote Fedora 39 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-def2f95af4 advisory. Security fix for CVE-2023-45661 CVE-2023-45662 CVE-2023-45663 CVE-2023-45664 CVE-2023-45666 CVE-2023-45667 CVE-2023-45675 CVE-2023-43281 ---- A new...

Amazon Linux 2023 : vorbis-tools (ALAS2023-2023-414)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-414 advisory. Buffer Overflow vulnerability in Vorbis-tools v.1.4.2 allows a local attacker to execute arbitrary code and cause a denial of service during the conversion of wav files to ogg files. CVE-2023-43361...

Low: vorbis-tools

Issue Overview: Buffer Overflow vulnerability in Vorbis-tools v.1.4.2 allows a local attacker to execute arbitrary code and cause a denial of service during the conversion of wav files to ogg files. CVE-2023-43361 Affected Packages: vorbis-tools Issue Correction: Run dnf update vorbis-tools...

SUSE: Security Advisory (SUSE-SU-2023:4251-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2023:4251-1 Security update for vorbis-tools

This update for vorbis-tools fixes the following issues: - CVE-2023-43361: Fixed a buffer overflow vulnerability during the conversion of wav files to ogg files. bsc1215942...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : vorbis-tools (SUSE-SU-2023:4251-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4251-1 advisory. - CVE-2023-43361: Fixed a buffer overflow vulnerability during the conversion of wav files to ogg files...

SUSE SLES12 Security Update : vorbis-tools (SUSE-SU-2023:4218-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4218-1 advisory. - CVE-2023-43361: Fixed a buffer overflow vulnerability during the conversion of wav files to ogg files. bsc1215942 Tenable has extracted th...

SUSE: Security Advisory (SUSE-SU-2023:4218-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2023:4218-1 Security update for vorbis-tools

This update for vorbis-tools fixes the following issues: - CVE-2023-43361: Fixed a buffer overflow vulnerability during the conversion of wav files to ogg files. bsc1215942...

Out Of Bounds Write

stbvorbis is vulnerable to Out Of Bounds Write. The vulnerability is due to the manipulation of the len variable when processing ogg vorbis files with the f-vendorlen = char'\0';' function. The attacker can exploit this issue by crafting a malicious file that causes the len read in startdecoder t...

Out Of Bounds Read

stbvorbis is vulnerable to Out of bounds Read.The vulnerability is due to the processing of ogg vorbis files using the DECODE macro. This can be exploited by the attacker by crafting a file that triggers an out of bounds read when the var is negative thus resulting in leakage of internal memory...

Out-of-Bounds Write

libstb.so is vulnerable to Out-of-Bounds Writes. This vulnerability exists in the f-vendorlen = char'\0' function of stbvorbis.c because it does not properly allocate memory, which allows to an attacker to perform a heap-based buffer overflow via a crafted ogg vorbis file...