--- title: "CVE-2014-1916\n | Ubuntu" description: Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things. url: https://ubuntu.com/security/CVE-2014-1916?format=md keywords: index, follow --- # CVE-2014-1916 Publication date 8 February 2014 Last updated 24 July 2024 --- Ubuntu priority **Low** [Why this priority?](https://ubuntu.com/security/cves/about#priority ) Toggle side navigation ## Description The (1) opus\_packet\_get\_nb\_frames and (2) opus\_packet\_get\_samples\_per\_frame functions in the client in MumbleKit before commit fd190328a9b24d37382b269a5674b0c0c7a7e36d and Mumble for iOS 1.1 through 1.2.2 do not properly check the return value of the copyDataBlock method, which allow remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted length prefix value in an Opus voice packet. [Read the notes from the security team](https://ubuntu.com/security/CVE-2014-1916?format=md#notes) ## Status Show unmaintained releases | Package | Ubuntu Release | Status | | --- | --- | --- | | mumble | 13.10 saucy | Not affected | | 12.10 quantal | Not affected | | 12.04 LTS precise | Not affected | | 10.04 LTS lucid | Not affected | --- * [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) * [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses) ## Notes --- ### [jdstrand](https://launchpad.net/~jdstrand) this is for MumbleKit, not Mumble. MumbleKit is a client framework for iOS and Mac OS X. Code not present in mumble ## References * [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1916) * [NVD](https://nvd.nist.gov/vuln/detail/CVE-2014-1916) * [Launchpad](https://launchpad.net/bugs/cve/CVE-2014-1916) * [Debian](https://security-tracker.debian.org/tracker/CVE-2014-1916) ### Other references * * *