Published: 16/05/2008 Updated: 29/10/2019

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P

Xiph.org libvorbis prior to 1.0 does not properly check for underpopulated Huffman trees, which allows remote malicious users to cause a denial of service (crash) via a crafted OGG file that triggers memory corruption during execution of the _make_decode_tree function.

Vulnerable Product	Search on Vulmon	Subscribe to Product
xiph.org libvorbis 1.0
canonical ubuntu linux 8.04
canonical ubuntu linux 8.10
canonical ubuntu linux 9.04
canonical ubuntu linux 9.10

It was discovered that libvorbis did not correctly handle ogg files with underpopulated Huffman trees If a user were tricked into opening a specially crafted ogg file with an application that uses libvorbis, an attacker could cause a denial of service (CVE-2008-2009) ...

Debian Bug report logs - #669196 libvorbisidec: multiple longstanding unfixed security issues in libvorbis Package: libvorbisidec; Maintainer for libvorbisidec is Debian Multimedia Maintainers <debian-multimedia@listsdebianorg>; Reported by: Michael Gilbert <mgilbert@debianorg> Date: Wed, 18 Apr 2012 03:21:01 UTC ...

Debian Bug report logs - #482039 libvorbis0a: potential security patch, needs review Package: libvorbis0a; Maintainer for libvorbis0a is Debian Multimedia Maintainers <debian-multimedia@listsdebianorg>; Source for libvorbis0a is src:libvorbis (PTS, buildd, popcon) Reported by: Steffen Joeris <steffenjoeris@skolelinuxd ...

NVD-CWE-Other https://bugzilla.redhat.com/show_bug.cgi?id=444443 http://www.redhat.com/support/errata/RHSA-2008-0271.html http://www.securitytracker.com/id?1020029 http://secunia.com/advisories/30247 http://www.ubuntu.com/usn/USN-861-1 http://www.vupen.com/english/advisories/2008/1510/references https://exchange.xforce.ibmcloud.com/vulnerabilities/42521 https://usn.ubuntu.com/861-1/https://nvd.nist.gov

CVE-2008-2009

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect