Out-of-bounds Array Read Vulnerability in libvorbis
Summary
CVE-2017-14633: In Xiph.Org libvorbis 1.3.5, an out-of-bounds array read vulnerability exists in the function mapping0_forward() in mapping0.c, which may lead to DoS when operating on a crafted audio file with vorbis_analysis(). Affects libvorbis across 2 version ranges.
< 1.3.5-r4
< f4093202cb226b360d0edf8a948aa71142cec657
Fixed in 1.3.5-r4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libvorbis is an open-source audio compression library developed by Xiph.Org. It provides support for encoding and decoding audio data in the Vorbis format. The library is widely used in various applications and platforms for audio processing. However, a vulnerability has been discovered in libvorbis version 1.3.5 that can lead to a denial-of-service (DoS) condition when processing a specially crafted audio file using the vorbis_analysis() function.
Vulnerability Detail
The vulnerability, identified as CVE-2017-14633, originates from an out-of-bounds array read issue in the mapping0_forward() function within the mapping0.c file of libvorbis. This flaw can be exploited by an attacker by providing a malicious audio file, causing the library to read data beyond the boundaries of an array. As a result, the application using libvorbis may crash or become unresponsive, leading to a DoS condition. The vulnerability has a CVSSv3 score of 6.5, indicating a medium severity level.
How To Fix
Minimum fixed version
1.3.5-r4
This is the first release that contains the fix.
sudo apk add --upgrade libvorbisTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. However, users can consider implementing general security practices such as validating input data and sanitizing user-supplied files to minimize the risk of encountering malicious audio files that exploit this vulnerability.
Conclusion
The out-of-bounds array read vulnerability in libvorbis version 1.3.5 can lead to a denial-of-service condition when processing malicious audio files. To mitigate this risk, it is crucial to update the libvorbis library to version 1.3.5-r4 or later. Users should ensure that all applications utilizing libvorbis are updated to the patched version. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libvorbis →
FAQ
libvorbis is an open-source audio compression library developed by Xiph.Org. It provides support for encoding and decoding audio data in the Vorbis format.
The vulnerability in libvorbis can lead to a denial-of-service (DoS) condition when processing a specially crafted audio file. This can cause the application using libvorbis to crash or become unresponsive.
To fix this vulnerability, update the libvorbis library to version 1.3.5-r4 or later. Ensure that all applications using libvorbis are updated to the patched version.
No specific workaround has been provided for this vulnerability. However, implementing general security practices such as input validation and file sanitization can help mitigate the risk.
The CVSSv3 score of this vulnerability is 6.5, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for libvorbis.
