Published: 08/04/2008 Updated: 11/10/2018

CVSS v2 Base Score: 9.3 | Impact Score: 10 | Exploitability Score: 8.6

VMScore: 828

Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Array index vulnerability in Speex 1.1.12 and previous versions, as used in libfishsound 0.9.0 and previous versions, including Illiminable DirectShow Filters and Annodex Plugins for Firefox, xine-lib prior to 1.1.12, and many other products, allows remote malicious users to execute arbitrary code via a header structure containing a negative offset, which is used to dereference a function pointer.

Vulnerable Product	Search on Vulmon	Subscribe to Product
xine xine-lib 1.1.10
xine xine-lib 1.1.1
xine xine-lib 0.9.8
xine xine-lib 0.9.13
xine xine-lib
xine xine-lib 1.1.10.1
xine xine-lib 1.0
xine xine-lib 0.99
xine xine-lib 1.1.0
xine xine-lib 1.0.3a
xine xine-lib 1.1.11
xine xine-lib 1.0.2
xine xine-lib 1.0.1
xiph speex 1.1.9
xiph speex 1.1.8
xiph speex 1.0.5
xiph speex 1.0.3
xiph speex 1.1.2
xiph speex 1.1.11
xiph speex 1.1.10
xiph speex 1.1.4
xiph speex 1.1.3
xiph speex 1.1.7
xiph speex 1.1.6
xiph speex 1.1.1
xiph speex 1.0.2
xiph speex
xiph speex 1.1.11.1
xiph speex 1.0.4
xiph speex 1.1.5
xiph libfishsound 0.7.0
xiph libfishsound 0.6.3
xiph libfishsound 0.8.1
xiph libfishsound 0.8.0
xiph libfishsound 0.5.41
xiph libfishsound 0.6.2
xiph libfishsound 0.6.1
xiph libfishsound
xiph libfishsound 0.6.0
xiph libfishsound 0.5.42

Debian Bug report logs - #475152 libfishsound: CVE-2008-1686 code execution via crafted header containing negative offsets Package: libfishsound1; Maintainer for libfishsound1 is Debian Multimedia Maintainers <debian-multimedia@listsdebianorg>; Source for libfishsound1 is src:libfishsound (PTS, buildd, popcon) Reported by: ...

Debian Bug report logs - #473057 vlc: CVE-2008-0073 code execution via crafted rtsp stream Package: vlc; Maintainer for vlc is Debian Multimedia Maintainers <debian-multimedia@listsdebianorg>; Source for vlc is src:vlc (PTS, buildd, popcon) Reported by: Nico Golde <nion@debianorg> Date: Fri, 28 Mar 2008 01:18:01 U ...

It was discovered that Speex did not properly validate its input when processing Speex file headers If a user or automated system were tricked into opening a specially crafted Speex file, an attacker could create a denial of service in applications linked against Speex or possibly execute arbitrary code as the user invoking the program ...

USN-611-1 fixed a vulnerability in Speex This update provides the corresponding update for GStreamer Good Plugins ...

USN-611-1 fixed a vulnerability in Speex This update provides the corresponding update for ogg123, part of vorbis-tools ...

Alin Rad Pop discovered an array index vulnerability in the SDP parser If a user or automated system were tricked into opening a malicious RTSP stream, a remote attacker may be able to execute arbitrary code with the privileges of the user invoking the program (CVE-2008-0073) ...

It was discovered that libfishsound, a simple programming interface that wraps XiphOrg audio codecs, didn't correctly handle negative values in a particular header field This could allow malicious files to execute arbitrary code For the stable distribution (etch), this problem has been fixed in version 070-2etch1 For the unstable distribution ...

Multiple vulnerabilities have been discovered in xine-lib, a library which supplies most of the application functionality of the xine multimedia player The Common Vulnerabilities and Exposures project identifies the following three problems: CVE-2008-1482 Integer overflow vulnerabilities exist in xine's FLV, QuickTime, RealMedia, MVE and ...

It was discovered that speex, the Speex codec command line tools, did not correctly deal with negative offsets in a particular header field This could allow a malicious file to execute arbitrary code For the stable distribution (etch), this problem has been fixed in version 1112-3etch1 We recommend that you upgrade your speex package ...

Get Started

CVE-2008-1686

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect