CVE-2008-2009

2008-05-1600:00:00

ubuntu.com

0.031 Low

EPSS

Percentile

91.0%

JSON

Xiph.org libvorbis before 1.0 does not properly check for underpopulated
Huffman trees, which allows remote attackers to cause a denial of service
(crash) via a crafted OGG file that triggers memory corruption during
execution of the _make_decode_tree function.

Bugs

Notes

Author	Note
mdeslaur	description is misleading, part of the patch applies to recent versions.

OSVersionArchitecturePackageVersionFilename
ubuntu8.04noarchlibvorbis< 1.2.0.dfsg-2ubuntu0.3UNKNOWN
ubuntu8.10noarchlibvorbis< 1.2.0.dfsg-3.1ubuntu0.8.10.2UNKNOWN
ubuntu9.04noarchlibvorbis< 1.2.0.dfsg-3.1ubuntu0.9.04.2UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	8.04	noarch	libvorbis	< 1.2.0.dfsg-2ubuntu0.3	UNKNOWN
ubuntu	8.10	noarch	libvorbis	< 1.2.0.dfsg-3.1ubuntu0.8.10.2	UNKNOWN
ubuntu	9.04	noarch	libvorbis	< 1.2.0.dfsg-3.1ubuntu0.9.04.2	UNKNOWN