6.8
CVSSv2

CVE-2008-1420

Published: 16/05/2008 Updated: 03/10/2018
CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6
VMScore: 605
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Vulnerability Summary

Integer overflow in residue partition value (aka partvals) evaluation in Xiph.org libvorbis 1.2.0 and previous versions allows remote malicious users to execute arbitrary code via a crafted OGG file, which triggers a heap overflow.

Vulnerable Product Search on Vulmon Subscribe to Product

xiph.org libvorbis 1.2.0

xiph.org libvorbis 1.0.1

xiph.org libvorbis 1.1.0

xiph.org libvorbis 1.1.1

xiph.org libvorbis 1.12

xiph.org libvorbis 1.0.0

Vendor Advisories

It was discovered that libvorbis did not correctly handle certain malformed ogg files If a user were tricked into opening a specially crafted ogg file with an application that uses libvorbis, an attacker could execute arbitrary code with the user’s privileges (CVE-2009-2663) ...
It was discovered that libvorbis did not correctly handle certain malformed sound files If a user were tricked into opening a specially crafted sound file with an application that uses libvorbis, an attacker could execute arbitrary code with the user’s privileges ...
Several local (remote) vulnerabilities have been discovered in libvorbis, a library for the Vorbis general-purpose compressed audio codec The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2008-1419 libvorbis does not properly handle a zero value which allows remote attackers to cause a denial of servi ...
Debian Bug report logs - #540958 libvorbis: CVE-2009-2663 vulnerability Package: libvorbis; Maintainer for libvorbis is Debian Multimedia Maintainers <debian-multimedia@listsdebianorg>; Reported by: Michael S Gilbert <michaelsgilbert@gmailcom> Date: Mon, 10 Aug 2009 23:36:01 UTC Severity: grave Tags: security F ...
Debian Bug report logs - #669196 libvorbisidec: multiple longstanding unfixed security issues in libvorbis Package: libvorbisidec; Maintainer for libvorbisidec is Debian Multimedia Maintainers <debian-multimedia@listsdebianorg>; Reported by: Michael Gilbert <mgilbert@debianorg> Date: Wed, 18 Apr 2012 03:21:01 UTC ...
Debian Bug report logs - #482518 libvorbis0a: possible integer overflows and DoS attacks Package: libvorbis0a; Maintainer for libvorbis0a is Debian Multimedia Maintainers <debian-multimedia@listsdebianorg>; Source for libvorbis0a is src:libvorbis (PTS, buildd, popcon) Reported by: Steffen Joeris <steffenjoeris@skolelin ...