CVE-2008-1686

2008-04-0800:00:00

ubuntu.com

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.068 Low

EPSS

Percentile

93.8%

JSON

Array index vulnerability in Speex 1.1.12 and earlier, as used in
libfishsound 0.9.0 and earlier, including Illiminable DirectShow Filters
and Annodex Plugins for Firefox, xine-lib before 1.1.12, and many other
products, allows remote attackers to execute arbitrary code via a header
structure containing a negative offset, which is used to dereference a
function pointer.

Bugs

Notes

Author	Note
jdstrand	upstream libfishsound should have a patch filed Debian bug #480059 for vorbis-tools (to hopefully get via merge in intrepid) Mandriva reference is a regression bug (and fix) for xine-lib

OSVersionArchitecturePackageVersionFilename
ubuntu6.06noarchgst-plugins-good0.10< 0.10.3-0ubuntu4.1UNKNOWN
ubuntu7.04noarchgst-plugins-good0.10< 0.10.5-1ubuntu2.1UNKNOWN
ubuntu7.10noarchgst-plugins-good0.10< 0.10.6-0ubuntu4.1UNKNOWN
ubuntu8.04noarchgst-plugins-good0.10< 0.10.7-3ubuntu0.1UNKNOWN
ubuntu8.04noarchlibfishsound< 0.7.0-2.1ubuntu0.1UNKNOWN
ubuntu6.06noarchspeex< 1.1.11.1-1ubuntu0.3UNKNOWN
ubuntu7.04noarchspeex< 1.1.12-3ubuntu0.7.04.1UNKNOWN
ubuntu7.10noarchspeex< 1.1.12-3ubuntu0.7.10.1UNKNOWN
ubuntu8.04noarchspeex< 1.1.12-3ubuntu0.8.04.1UNKNOWN
ubuntu8.04noarchvlc< 0.8.6.release.e+x264svn20071224+faad2.6.1-0ubuntu3.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	6.06	noarch	gst-plugins-good0.10	< 0.10.3-0ubuntu4.1	UNKNOWN
ubuntu	7.04	noarch	gst-plugins-good0.10	< 0.10.5-1ubuntu2.1	UNKNOWN
ubuntu	7.10	noarch	gst-plugins-good0.10	< 0.10.6-0ubuntu4.1	UNKNOWN
ubuntu	8.04	noarch	gst-plugins-good0.10	< 0.10.7-3ubuntu0.1	UNKNOWN
ubuntu	8.04	noarch	libfishsound	< 0.7.0-2.1ubuntu0.1	UNKNOWN
ubuntu	6.06	noarch	speex	< 1.1.11.1-1ubuntu0.3	UNKNOWN
ubuntu	7.04	noarch	speex	< 1.1.12-3ubuntu0.7.04.1	UNKNOWN
ubuntu	7.10	noarch	speex	< 1.1.12-3ubuntu0.7.10.1	UNKNOWN
ubuntu	8.04	noarch	speex	< 1.1.12-3ubuntu0.8.04.1	UNKNOWN
ubuntu	8.04	noarch	vlc	< 0.8.6.release.e+x264svn20071224+faad2.6.1-0ubuntu3.1	UNKNOWN