libvorbis Bugs Let Remote Users Deny Service or Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1020029
|
|
SecurityTracker URL: http://securitytracker.com/id?1020029
|
|
CVE Reference: CVE-2008-1419
, CVE-2008-1420
, CVE-2008-1423
, CVE-2008-2009
(Links to External Site)
|
Date: May 15 2008
|
Impact: Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): 1.2.0
|
Description: Several vulnerabilities were reported in libvorbis. A remote user can cause arbitrary code to be executed on the target user's system.
A remote user can create a specially crafted OGG audio file that, when processed by the target application, will trigger an integer
overflow, heap overflow, or memory corruption error and crash or execute arbitrary code on the target system. The code will run
with the privileges of the target application.
Will Drewry of the Google Security Team reported these vulnerabilities.
|
Impact: A remote user can create a file that, when loaded by the target application, will execute arbitrary code on the target system.
|
Solution: The vendor has issued a source code fix.
|
Vendor URL: xiph.org/vorbis/ (Links to External Site)
|
Cause: Boundary error
|
Underlying OS: Linux (Any), UNIX (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Wed, 14 May 2008 23:20:45 -0400
Subject: libvorbis
|
CVE-2008-1419, CVE-2008-1420, CVE-2008-1423
|
|
