Xiph.org Libvorbis
13 CVEs affecting Xiph.org Libvorbis. Latest disclosed: 2020-12-26. Critical: 1, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-14632 | Critical | 9.8 | 2017-09-21 | Xiph.Org libvorbis 1.3.5 allows Remote Code Execution upon freeing uninitialized memory in the function vorbis_analysis_headerout() in info.c when vi->channels… |
CVE-2018-10392 | High | 8.8 | 2018-04-26 | mapping0_forward in mapping0.c in Xiph.Org libvorbis 1.3.6 does not validate the number of channels, which allows remote attackers to cause a denial of service… |
CVE-2017-14160 | High | 8.8 | 2017-09-21 | The bark_noise_hybridmp function in psy.c in Xiph.Org libvorbis 1.3.5 allows remote attackers to cause a denial of service (out-of-bounds access and applicatio… |
CVE-2018-10393 | High | 7.5 | 2018-04-26 | bark_noise_hybridmp in psy.c in Xiph.Org libvorbis 1.3.6 has a stack-based buffer over-read. |
CVE-2020-20412 | Medium | 6.5 | 2020-12-26 | lib/codebook.c in libvorbis before 1.3.6, as used in StepMania 5.0.12 and other products, has insufficient array bounds checking via a crafted OGG file. NOTE… |
CVE-2017-14633 | Medium | 6.5 | 2017-09-21 | In Xiph.Org libvorbis 1.3.5, an out-of-bounds array read vulnerability exists in the function mapping0_forward() in mapping0.c, which may lead to DoS when oper… |
CVE-2017-11333 | Medium | 5.5 | 2017-07-31 | The vorbis_analysis_wrote function in lib/block.c in Xiph.Org libvorbis 1.3.5 allows remote attackers to cause a denial of service (OOM) via a crafted wav file. |
CVE-2008-2009 | | 2008-05-16 | Xiph.org libvorbis before 1.0 does not properly check for underpopulated Huffman trees, which allows remote attackers to cause a denial of service (crash) via… | |
CVE-2008-1423 | | 2008-05-16 | Integer overflow in a certain quantvals and quantlist calculation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to cause a denial of service… | |
CVE-2008-1420 | | 2008-05-16 | Integer overflow in residue partition value (aka partvals) evaluation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to execute arbitrary code… | |
CVE-2008-1419 | | 2008-05-16 | Xiph.org libvorbis 1.2.0 and earlier does not properly handle a zero value for codebook.dim, which allows remote attackers to cause a denial of service (crash… | |
CVE-2007-4066 | | 2007-09-21 | Multiple buffer overflows in Xiph.Org libvorbis before 1.2.0 allow context-dependent attackers to cause a denial of service or have other unspecified impact vi… | |
CVE-2007-4065 | | 2007-09-21 | lib/vorbisfile.c in libvorbisfile in Xiph.Org libvorbis before 1.2.0 allows context-dependent attackers to cause a denial of service (infinite loop) via a craf… |