Vulnerability in Mumble VoIP Client
Summary
DSA-2854-1: mumble - several. Affects mumble versions < 1.2.3-349-g315b5f5-2.2+deb7u1. Fixed in 1.2.3-349-g315b5f5-2.2+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mumble is a low latency VoIP client used for voice communication during online gaming or other collaborative activities. It provides a real-time audio stream between users and supports features like positional audio and encryption. However, the Mumble client is susceptible to several vulnerabilities that can be exploited by remote attackers.
Vulnerability Detail
The identified vulnerabilities in Mumble are as follows:
-
CVE-2014-0044: A malformed Opus voice packet sent to a Mumble client can lead to a NULL pointer dereference or an out-of-bounds array access. This can be exploited by a malicious remote attacker to cause a denial of service (DoS) attack by crashing the Mumble client.
-
CVE-2014-0045: A malformed Opus voice packet sent to a Mumble client can trigger a heap-based buffer overflow. This vulnerability can be abused by a remote attacker to crash the client or potentially execute arbitrary code.
How To Fix
Minimum fixed version
1.2.3-349-g315b5f5-2.2+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade mumbleTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities. It is crucial to apply the recommended fix by upgrading the Mumble packages to the patched version.
Conclusion
The Mumble VoIP client is vulnerable to two identified issues, CVE-2014-0044 and CVE-2014-0045. These vulnerabilities can be mitigated by upgrading the Mumble packages to version 1.2.3-349-g315b5f5-2.2+deb7u1 or later. It is crucial to apply the recommended fix to ensure the security and stability of the Mumble client. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for mumble →
FAQ
Mumble is a low latency VoIP client used for real-time voice communication during online gaming or collaborative activities.
The identified vulnerabilities in Mumble are CVE-2014-0044 and CVE-2014-0045. These vulnerabilities can be exploited by remote attackers to cause denial of service (DoS) attacks or potentially execute arbitrary code.
To fix the vulnerabilities, it is recommended to upgrade the Mumble packages to version 1.2.3-349-g315b5f5-2.2+deb7u1 or later.
No specific workarounds have been mentioned for these vulnerabilities. It is essential to apply the recommended fix by upgrading the Mumble packages.
For more information about these vulnerabilities, you can refer to the Common Vulnerabilities and Exposures (CVE) entries: CVE-2014-0044 and CVE-2014-0045.
Related vulnerabilities
Recent vulnerabilities recorded for mumble.
