CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-43361 – vorbis-tools: Buffer Overflow vulnerability
https://notcve.org/view.php?id=CVE-2023-43361
Buffer Overflow vulnerability in Vorbis-tools v.1.4.2 allows a local attacker to execute arbitrary code and cause a denial of service during the conversion of wav files to ogg files. La vulnerabilidad de desbordamiento de búfer en Vorbis-tools v.1.4.2 permite a un atacante local ejecutar código arbitrario y provocar una denegación de servicio durante la conversión de archivos wav a archivos ogg. A buffer overflow vulnerability was found in vorbis-tools. This flaw allows a local attacker to execute arbitrary code and cause a denial of service during the conversion of WAV files to OGG files. • https://github.com/xiph/vorbis https://github.com/xiph/vorbis-tools https://github.com/xiph/vorbis-tools/issues/41 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GJKTWQXOZDMCXVEFCQZVH3F3FQYMNYLI https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T47YXGRUCUKN7WEOHUEIUNJ2KZ2C2IDN https://xiph.org/vorbis https://access.redhat.com/security/cve/CVE-2023-43361 https://bugzilla.redhat.com/show_bug.cgi?id=2242151 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 1CVE-2022-47021
https://notcve.org/view.php?id=CVE-2022-47021
A null pointer dereference issue was discovered in functions op_get_data and op_open1 in opusfile.c in xiph opusfile 0.9 thru 0.12 allows attackers to cause denial of service or other unspecified impacts. Se descubrió un problema de desreferencia de puntero null en las funciones op_get_data y op_open1 en opusfile.c en xiph opusfile 0.9 a 0.12 que permite a los atacantes causar denegación de servicio u otros impactos no especificados. • https://github.com/xiph/opusfile/commit/0a4cd796df5b030cb866f3f4a5e41a4b92caddf5 https://github.com/xiph/opusfile/issues/36 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ODIA6QRIRBNF2HRXOE5VCZ2AFP4ZB4R https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4LIKBLOE433RA44YTYUZLED4IOWJG5DV https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ED4CWLBR2WQ2IXXTHZ24UYZBRNCLMJXH https://lists.fedoraproject.org/archives/list/package-announ • CWE-476: NULL Pointer Dereference •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2020-23904
https://notcve.org/view.php?id=CVE-2020-23904
A stack buffer overflow in speexenc.c of Speex v1.2 allows attackers to cause a denial of service (DoS) via a crafted WAV file. NOTE: the vendor states "I cannot reproduce it" and it "is a demo program. **EN DISPUTA** Un desbordamiento del búfer de la pila en el archivo speexenc.c de Speex versión v1.2, permite a atacantes causar una denegación de servicio (DoS) por medio de un archivo WAV diseñado. NOTA: el vendedor afirma que "no puedo reproducirlo" y que "es un programa de demostración". • https://github.com/xiph/speex/issues/14 • CWE-787: Out-of-bounds Write •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 1CVE-2020-23903 – speex: divide by zero in read_samples() via crafted WAV file
https://notcve.org/view.php?id=CVE-2020-23903
A Divide by Zero vulnerability in the function static int read_samples of Speex v1.2 allows attackers to cause a denial of service (DoS) via a crafted WAV file. Una vulnerabilidad de división por cero en la función static int read_samples de Speex versión v1.2, permite a atacantes causar una denegación de servicio (DoS) por medio de un archivo WAV diseñado A divide-by-zero flaw was found in speex within the read_samples() at src/speexenc.c function. This flaw allows a malicious user to provide a crafted wav file and crash the speexenc utility, resulting in a denial of service. The highest threat from this vulnerability is to system availability. • https://github.com/xiph/speex/issues/13 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LXCRAYNW5ESCE2PIGTUXZNZHNYFLJ6PX https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R3SEV2ZRR47GSD3M7O5PH4XEJMKJJNG2 https://access.redhat.com/security/cve/CVE-2020-23903 https://bugzilla.redhat.com/show_bug.cgi?id=2024250 • CWE-369: Divide By Zero •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 1CVE-2020-20412
https://notcve.org/view.php?id=CVE-2020-20412
lib/codebook.c in libvorbis before 1.3.6, as used in StepMania 5.0.12 and other products, has insufficient array bounds checking via a crafted OGG file. NOTE: this may overlap CVE-2018-5146. La biblioteca lib/codebook.c en libvorbis versiones anteriores a 1.3.6, como es usado en StepMania versión 5.0.12 y otros productos, presenta una comprobación de límites de matriz insuficiente por medio de un archivo OGG diseñado • https://github.com/stepmania/stepmania/issues/1890 • CWE-129: Improper Validation of Array Index •