libvorbis vulnerabilities

2007-08-1600:00:00

ubuntu.com

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.2

Confidence

Low

EPSS

0.033

Percentile

91.4%

JSON

Releases

Ubuntu 7.04
Ubuntu 6.10
Ubuntu 6.06

Details

David Thiel discovered that libvorbis did not correctly verify the size
of certain headers, and did not correctly clean up a broken stream.
If a user were tricked into processing a specially crafted Vorbis stream,
a remote attacker could execute arbitrary code with the user’s privileges.

OSVersionArchitecturePackageVersionFilename
Ubuntu7.04noarchlibvorbis0a< 1.1.2.dfsg-1.2ubuntu2UNKNOWN
Ubuntu6.10noarchlibvorbis0a< 1.1.2-1ubuntu1.2UNKNOWN
Ubuntu6.06noarchlibvorbis0a< 1.1.2-0ubuntu2.2UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Ubuntu	7.04	noarch	libvorbis0a	< 1.1.2.dfsg-1.2ubuntu2	UNKNOWN
Ubuntu	6.10	noarch	libvorbis0a	< 1.1.2-1ubuntu1.2	UNKNOWN
Ubuntu	6.06	noarch	libvorbis0a	< 1.1.2-0ubuntu2.2	UNKNOWN