Vulnerability in Xiph.org Libvorbis

CVE-2008-2009

Xiph.org libvorbis before 1.0 does not properly check for underpopulated Huffman trees, which allows remote attackers to cause a denial of service (crash) via a crafted OGG file that triggers memory corruption during execution of the _make…

EPSS: 0.035 (88.0th percentile) — read the EPSS interpretation.

Affected products

Xiph.org Libvorbis — versions 1.0
Canonical Ubuntu_linux — versions 8.04, 8.10, 9.04
N/a — versions n/a

References

secalert@redhat.com (x_refsource_CONFIRM, Third Party Advisory, Issue Tracking)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
secalert@redhat.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK)
secalert@redhat.com (x_refsource_UBUNTU, vendor-advisory, Third Party Advisory)
secalert@redhat.com (Third Party Advisory, vdb-entry, x_refsource_VUPEN)
secalert@redhat.com (x_refsource_SECUNIA, Third Party Advisory, third-party-advisory)
secalert@redhat.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_XF)