opus security breach

opus is an open source native binding to libopus v1.3 by discord.js. A security vulnerability exists in opus that stems from supplying input objects with the toString attribute to several different functions, making it susceptible to denial of service DoS attacks...

PT-2024-18935 · Unknown · @Discordjs/Opus

Name of the Vulnerable Software and Affected Versions: @discordjs/opus versions all Description: The issue is related to a Denial of Service DoS condition that can occur when an input object with a toString property is provided to several different functions. This can lead to a system or process...

PT-2024-18936 · Audify · Audify

Name of the Vulnerable Software and Affected Versions: audify versions all Description: The issue arises from improper validation of array index when frameSize is provided to the new OpusDecoder.decode or new OpusDecoder.decodeFloat functions, as it is not checked for negative values. This can le...

RHEL 7 : opus (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - opus: Memory corruption during media file and data processing CVE-2017-0381 Note that Nessus has not tested for thi...

RHEL 5 : opus (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - opus: Memory corruption during media file and data processing CVE-2017-0381 Note that Nessus has not tested for thi...

RHEL 5 : opus (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - opus: Memory corruption during media file and data processing CVE-2017-0381 Note that Nessus has not tested for thi...

RHEL 6 : opus (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - opus: Memory corruption during media file and data processing CVE-2017-0381 Note that Nessus has not tested for thi...

RHEL 7 : opus (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - opus: Memory corruption during media file and data processing CVE-2017-0381 Note that Nessus has not tested for thi...

Improper Validation of Array Index

Overview audify is a Play/Stream/Record PCM audio data & Encode/Decode Opus to PCM audio data Affected versions of this package are vulnerable to Improper Validation of Array Index when frameSize is provided to the new OpusDecoder.decode or new OpusDecoder.decodeFloat functions it is not checked...

Denial of Service (DoS)

Overview @discordjs/opus is a native bindings to libopus. Affected versions of this package are vulnerable to Denial of Service DoS due to providing an input object with a property toString to several different functions. Exploiting this vulnerability could lead to a system crash. Details Denial ...

24-hr-music (1.0.3), 2pg-music (>=1.0.0, <=1.1.2) +195 more potentially affected by CVE-2024-21521 via @discordjs/opus (>=0.1.0, <=0.9.0)

@discordjs/opus NPM version =0.1.0, =1.0.0, =1.1.2, =1.0.0, =1.0.0, =2.0.0, =1.0.3, =1.0.1, =1.0.0, =0.1.0, =0.1.2 and more Source cves: CVE-2024-21521 Source advisory: SNYK:JS-DISCORDJSOPUS-6370643...

CVE-2023-40078

In a2dpvendoropusdecoderdecodepacket of a2dpvendoropusdecoder.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to paired device escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2023-27252 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions prior to the fixed version Description: The issue is related to a possible out of bounds write due to a heap buffer overflow in the a2dp vendor opus decoder decode packet function of a2dp vendor opus decoder.cc. This could le...

opus-srl.it Cross Site Scripting vulnerability OBB-3571295

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

opus-communication.de Cross Site Scripting vulnerability OBB-3263020

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

[SECURITY] Fedora 38 Update: loudgain-0.6.8-13.fc38

loudgain is a versatile ReplayGain 2.0 loudness normalizer, based on the EBU R128/ITU BS.1770 standard -18 LUFS and supports FLAC/Ogg/MP2/MP3/MP4/M4A/ALAC/Opus/ASF/WMA/WAV/WavPack/AIFF/APE audio files. It uses the well-known mp3gain commandline syntax but will never modify the actual audio data...

Fedora: Security Advisory for loudgain (FEDORA-2023-a5e10b188a)

The remote host is missing an update for the Copyright C 2023 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Debian: Security Advisory (DLA-793-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE CVE-2013-0899

Integer overflow in the padding implementation in the opuspacketparseimpl function in src/opusdecoder.c in Opus before 1.0.2, as used in Google Chrome before 25.0.1364.97 on Windows and Linux and before 25.0.1364.99 on Mac OS X and other products, allows remote attackers to cause a denial of...

SUSE CVE-2014-0045

The needSamples method in AudioOutputSpeech.cpp in the client in Mumble 1.2.4 and the 1.2.3 pre-release snapshots, Mumble for iOS 1.1 through 1.2.2, and MumbleKit before commit fd190328a9b24d37382b269a5674b0c0c7a7e36d does not check the return value of the opusdecodefloat function, which allows...