Critical Division-by-Zero Vulnerability in LAME Package
Summary
ALPINE-CVE-2017-11720: There is a division-by-zero vulnerability in LAME 3.99.5, caused by a malformed input file. Affects lame versions < 3.99.5-r6. Fixed in 3.99.5-r6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LAME is a widely used open-source audio encoder that converts audio files into MP3 format. It is known for its high-quality audio output and is utilized in various applications for audio processing. The package is available across multiple Linux distributions, including Alpine Linux. The vulnerability in question affects multiple versions of LAME, making it crucial for users to be aware of its implications.
Vulnerability Detail
The vulnerability identified as CVE-2017-11720 is a division-by-zero flaw present in LAME version 3.99.5. This issue arises from the processing of malformed input files, which can lead to application crashes or unexpected behavior. The severity of this vulnerability is underscored by its CVSS score of 9.8, indicating a critical risk to systems utilizing the affected versions of LAME. Attackers could exploit this vulnerability to cause denial of service or potentially execute arbitrary code.
How To Fix
Minimum fixed version
3.99.5-r6
This is the first release that contains the fix.
sudo apk add --upgrade lameTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid processing untrusted or malformed audio files until the package is updated. This precaution can help mitigate the risk of exploitation while waiting for a proper fix.
Conclusion
The division-by-zero vulnerability in the LAME package poses a significant risk to users, with a CVSS score of 9.8 indicating its critical nature. Users are strongly advised to update to the patched version to ensure their systems remain secure. For those unable to update immediately, implementing workarounds can help mitigate potential risks.
See every vulnerability recorded for lame →
FAQ
CVE-2017-11720 is a critical division-by-zero vulnerability found in the LAME audio encoder, which can lead to application crashes.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Exploitation of this vulnerability can result in denial of service or unexpected behavior in applications using the affected LAME versions.
Yes, the patched version of LAME is 3.99.5-r6. Users should update to this version to mitigate the vulnerability.
If immediate updates are not possible, avoid processing untrusted audio files to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for lame.
