Security Update for libvorbis
Summary
DLA-1368-1: libvorbis - security update. Affects libvorbis versions < 1.3.2-1.3+deb7u1. Fixed in 1.3.2-1.3+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libvorbis is a widely used library for encoding and decoding audio in OGG containers. It is commonly utilized in various applications and systems to handle audio files. However, several serious vulnerabilities have been discovered in the libvorbis library.
Vulnerability Detail
The libvorbis library is affected by multiple vulnerabilities:
-
CVE-2017-14633: An out-of-bounds array read vulnerability exists in the mapping0_forward() function in mapping0.c. This vulnerability can lead to a denial of service (DoS) when processing a specially crafted audio file with vorbis_analysis().
-
CVE-2017-14632: libvorbis allows remote code execution by freeing uninitialized memory in the vorbis_analysis_headerout() function in info.c when the number of audio channels (vi->channels) is less than or equal to zero.
-
CVE-2017-11333: The vorbis_analysis_wrote() function in lib/block.c allows remote attackers to cause a denial of service (out-of-memory) via a crafted WAV file.
-
CVE-2018-5146: An out-of-bounds memory write vulnerability exists in the codebook parsing code of the libvorbis library. Exploiting this vulnerability could result in the execution of arbitrary code.
How To Fix
Minimum fixed version
1.3.2-1.3+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libvorbisTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the libvorbis library is affected by multiple vulnerabilities that can lead to various security risks. It is crucial to upgrade your libvorbis packages to the recommended version to mitigate these vulnerabilities. For further support and assistance with vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for libvorbis →
FAQ
libvorbis is an open-source library used for encoding and decoding audio in OGG containers. It is commonly employed in various applications and systems to handle audio files.
These vulnerabilities can lead to various security issues, including denial of service (DoS) attacks, remote code execution, and potential execution of arbitrary code. Attackers may exploit these vulnerabilities to compromise systems or cause disruption.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application or system is affected by these vulnerabilities. Simply upload your manifest file (e.g., package-lock.json) to the playground, and it will provide real-time alerts for open-source vulnerabilities.
At the moment, there are no known workarounds for these vulnerabilities. It is strongly recommended to apply the provided security update to mitigate the risks.
You can find further information about Debian LTS security advisories, including how to apply updates and frequently asked questions, on the Debian LTS wiki: https://wiki.debian.org/LTS
Related vulnerabilities
Recent vulnerabilities recorded for libvorbis.
