CVE-2008-1686 | Ubuntu

Array index vulnerability in Speex 1.1.12 and earlier, as used in libfishsound 0.9.0 and earlier, including Illiminable DirectShow Filters and Annodex Plugins for Firefox, xine-lib before 1.1.12, and many other products, allows remote attackers to execute arbitrary code via a header structure containing a negative offset, which is used to dereference a function pointer.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
gst-plugins-good0.10	11.10 oneiric	Not affected
	11.04 natty	Not affected
	10.10 maverick	Not affected
	10.04 LTS lucid	Not affected
	9.10 karmic	Not affected
	9.04 jaunty	Not affected
	8.10 intrepid	Not affected
	8.04 LTS hardy	Fixed 0.10.7-3ubuntu0.1
	7.10 gutsy	Fixed 0.10.6-0ubuntu4.1
	7.04 feisty	Fixed 0.10.5-1ubuntu2.1
	6.06 LTS dapper	Fixed 0.10.3-0ubuntu4.1
libfishsound	11.10 oneiric	Not affected
	11.04 natty	Not affected
	10.10 maverick	Not affected
	10.04 LTS lucid	Not affected
	9.10 karmic	Not affected
	9.04 jaunty	Not affected
	8.10 intrepid	Not affected
	8.04 LTS hardy	Fixed 0.7.0-2.1ubuntu0.1
	7.10 gutsy	Ignored end of life, was needed
	7.04 feisty	Ignored end of life, was needed
	6.10 edgy	Ignored end of life, was needed
	6.06 LTS dapper	Ignored end of life
speex	11.10 oneiric	Not affected
	11.04 natty	Not affected
	10.10 maverick	Not affected
	10.04 LTS lucid	Not affected
	9.10 karmic	Not affected
	9.04 jaunty	Not affected
	8.10 intrepid	Not affected
	8.04 LTS hardy	Fixed 1.1.12-3ubuntu0.8.04.1
	7.10 gutsy	Fixed 1.1.12-3ubuntu0.7.10.1
	7.04 feisty	Fixed 1.1.12-3ubuntu0.7.04.1
	6.10 edgy	Ignored end of life, was needed
	6.06 LTS dapper	Fixed 1.1.11.1-1ubuntu0.3
sweep	11.10 oneiric	Not affected
	11.04 natty	Not affected
	10.10 maverick	Not affected
	10.04 LTS lucid	Not affected
	9.10 karmic	Not affected
	9.04 jaunty	Not affected
	8.10 intrepid	Ignored end of life, was needed
	8.04 LTS hardy	Ignored end of life
	7.10 gutsy	Ignored end of life, was needed
	7.04 feisty	Ignored end of life, was needed
	6.06 LTS dapper	Ignored end of life
vlc	11.10 oneiric	Fixed 0.8.6.release.h-1ubuntu1
	11.04 natty	Fixed 0.8.6.release.h-1ubuntu1
	10.10 maverick	Fixed 0.8.6.release.h-1ubuntu1
	10.04 LTS lucid	Fixed 0.8.6.release.h-1ubuntu1
	9.10 karmic	Fixed 0.8.6.release.h-1ubuntu1
	9.04 jaunty	Fixed 0.8.6.release.h-1ubuntu1
	8.10 intrepid	Fixed 0.8.6.release.h-1ubuntu1
	8.04 LTS hardy	Fixed 0.8.6.release.e+x264svn20071224+faad2.6.1-0ubuntu3.1
	7.10 gutsy	Ignored end of life, was needed
	7.04 feisty	Ignored end of life, was needed
	6.06 LTS dapper	Ignored end of life
vorbis-tools	11.10 oneiric	Fixed 1.2.0-2
	11.04 natty	Fixed 1.2.0-2
	10.10 maverick	Fixed 1.2.0-2
	10.04 LTS lucid	Fixed 1.2.0-2
	9.10 karmic	Fixed 1.2.0-2
	9.04 jaunty	Fixed 1.2.0-2
	8.10 intrepid	Fixed 1.2.0-2
	8.04 LTS hardy	Fixed 1.1.1-15ubuntu0.1
	7.10 gutsy	Fixed 1.1.1-13ubuntu0.1
	7.04 feisty	Fixed 1.1.1-6ubuntu0.1
	6.06 LTS dapper	Fixed 1.1.1-3ubuntu0.1
xine-lib	11.10 oneiric	Not affected
	11.04 natty	Not affected
	10.10 maverick	Not affected
	10.04 LTS lucid	Not affected
	9.10 karmic	Not affected
	9.04 jaunty	Not affected
	8.10 intrepid	Not affected
	8.04 LTS hardy	Fixed 1.1.11.1-1ubuntu3.1
	7.10 gutsy	Fixed 1.1.7-1ubuntu1.3
	7.04 feisty	Fixed 1.1.4-2ubuntu3.1
	6.06 LTS dapper	Fixed 1.1.1+ubuntu2-7.9
xmms-speex	11.10 oneiric	Not in release
	11.04 natty	Not in release
	10.10 maverick	Not in release
	10.04 LTS lucid	Not in release
	9.10 karmic	Not in release
	9.04 jaunty	Not in release
	8.10 intrepid	Not in release
	8.04 LTS hardy	Not in release
	7.10 gutsy	Ignored end of life, was needed
	7.04 feisty	Ignored end of life, was needed
	6.06 LTS dapper	Not in release

Notes

jdstrand

upstream libfishsound should have a patch filed Debian bug #480059 for vorbis-tools (to hopefully get via merge in intrepid) Mandriva reference is a regression bug (and fix) for xine-lib

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
gst-plugins-good0.10	Vendor: http://www.mandriva.com/en/security/advisories?name=MDVSA-2008:092 Upstream: http://webcvs.freedesktop.org/gstreamer/gst-plugins-good/ext/speex/gstspeexdec.c?r1=1.40&r2=1.41
speex	Vendor: http://www.mandriva.com/en/security/advisories?name=MDVSA-2008:094 Vendor: http://rhn.redhat.com/errata/RHSA-2008-0235.html
vlc	Other: http://trac.videolan.org/vlc/changeset/c1c81073e661f7d80197711ab11753e1e170b44c
vorbis-tools	Vendor: http://www.mandriva.com/en/security/advisories?name=MDVSA-2008:093 Upstream: https://trac.xiph.org/changeset/14701
xine-lib	Other: http://hg.debian.org/hg/xine-lib/xine-lib/?cmd=changeset;node=d8e1305c13820b82d896f7bc77d196b9c9645dd6;style=raw

References

Related Ubuntu Security Notices (USN)

USN-611-2
vorbis-tools vulnerability
8 May 2008

USN-611-3
GStreamer Good Plugins vulnerability
8 May 2008

USN-635-1
xine-lib vulnerabilities
6 August 2008

USN-611-1
Speex vulnerability
8 May 2008

Other references

https://www.cve.org/CVERecord?id=CVE-2008-1686