CVE-2017-11333

CVE-2017-11333 affects Xiph.Org libvorbis 1.3.5, where vorbis_analysis_wrote in lib/block.c can trigger a denial of service (OOM) via a crafted WAV file. Public details in connected pages indicate this is practical, with Debian DLA-2039-1 noting fixes in libvorbis 1.3.4-2+deb8u3 and Red Hat/Nessu...

CVE-2017-14633

CVE-2017-14633 : In Xiph.Org libvorbis 1.3.5, there is an out-of-bounds array read in mapping0_forward() of mapping0.c that may cause a denial of service when processing a crafted audio file with vorbis_analysis(). The issue is fixed upstream in libvorbis 1.3.6. Public advisories across distribut...

CVE-2017-14632

Xiph.Org libvorbis 1.3.5 is vulnerable to CVE-2017-14632: remote code execution via freeing uninitialized memory in vorbis_analysis_headerout() when vi->channels

CVE-2018-10392

CVE-2018-10392 affects Xiph.Org libvorbis 1.3.6 where mapping0_forward in mapping0.c does not validate the number of channels, allowing a remote attacker to cause denial of service via a crafted file (heap-based overflow or over-read). The issue is fixed in later libvorbis releases (mitigation ty...

CVE-2018-10393

CVE-2018-10393 affects libvorbis 1.3.6: bark_noise_hybridmp in psy.c causes a stack-based buffer over-read. Affected software is the libvorbis library (Xiph.org) and downstream packages (Debian/AlmaLinux/Gentoo advisories reference libvorbis ≤1.3.6). Impact is memory-safe violation potential; in ...

CVE-2017-14160

The CVE-2017-14160 issue affects Xiph.Org libvorbis, specifically the bark_noise_hybridmp function in psy.c of version 1.3.5, which can be triggered by a crafted MP4 file to cause out-of-bounds access and a denial of service (and possibly other impact). Several advisories note this vulnerability ...

CVE-2020-20412

CVE-2018-5146 corresponds to an out-of-bounds memory write in libvorbis Vorbis audio processing. Documentation shows this affects libvorbis builds and was fixed upstream by updating in the 1.3.6 series (vuln exists in libvorbis before 1.3.6, as used by affected products). Root cause is insufficie...

CVE-2008-1420

Libvorbis (CVE-2008-1419, CVE-2008-1420, CVE-2008-1423) contains an integer overflow in residue partition value evaluation that can trigger a heap overflow and potentially allow remote code execution via a crafted OGG file. The issue was reported across multiple distributions (Ubuntu, SuSE, Mandr...

CVE-2008-2009

CVE-2008-2009 affects libvorbis prior to 1.0, where underpopulated Huffman trees in OGG decoding can crash or memory-corrupt the process when processing a crafted OGG file. The issue arises during execution of _make_decode_tree and is tied to remote attack conditions. Multiple connected advisorie...

CVE-2008-1419

CVE-2008-1419 affects Xiph.org libvorbis 1.2.0 and earlier. A zero value for codebook.dim is not properly handled, allowing a remote attacker to cause a crash, infinite loop, or an integer overflow, potentially enabling code execution or Denial of Service when processing crafted OGG Vorbis stream...

CVE-2008-1423

CVE-2008-1423 affects Xiph.org libvorbis up to version 1.2.0 and earlier, due to an integer overflow in a specific quantvals/quantlist calculation that can trigger a heap-based overflow when processing crafted OGG files with large virtual codebooks. This can lead to a crash or remote code executi...

CVE-2007-4066

CVE-2007-4066 concerns multiple buffer overflows in libvorbis (pre-1.2.0) that can be triggered by a crafted OGG file, enabling a context-dependent attacker to cause denial of service or other unspecified impact. The vulnerability stems from an overflow in oggenc.exe related to the _psy_noiseguar...

CVE-2007-4065

CVE-2007-4065 concerns libvorbisfile in Xiph.Org libvorbis prior to 1.2.0, where a crafted OGG file can trigger an infinite loop in context-dependent attackers, causing a denial of service. Multiple advisories (e.g., RHSA-2007-0845, SLES/SUSE updates, Fedora/Mandriva/Scientific Linux/OpenVAS list...