Your submission was sent successfully! Close

CVE-2017-11331

Published: 31 July 2017

The wav_open function in oggenc/audio.c in Xiph.Org vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (memory allocation error) via a crafted wav file.

Notes

AuthorNote
ratliff
The following notes are from Debian:
debian
NOTE: The issue is "covered" by the fix applied in 0016-oggenc-validate-count-of-channels-in-the-header-CVE-.patch
NOTE: still the return of malloc is not checked.
NOTE: Crash in CLI tool only, negligible security impact
Priority

Low

CVSS 3 base score: 5.5

Status

Package Release Status
vorbis-tools
Launchpad, Ubuntu, Debian
artful Ignored
(reached end-of-life)
bionic Needed

cosmic Ignored
(reached end-of-life)
disco Ignored
(reached end-of-life)
eoan Ignored
(reached end-of-life)
focal Needed

groovy Ignored
(reached end-of-life)
hirsute Ignored
(reached end-of-life)
impish Ignored
(reached end-of-life)
jammy Needed

precise Does not exist

trusty Does not exist
(trusty was needed)
upstream Needs triage

xenial Ignored
(end of standard support, was needed)
zesty Ignored
(reached end-of-life)