CVSS: 7.5EPSS: 11%CPEs: 14EXPL: 1CVE-2008-1419 – vorbis: zero-dim codebooks can cause crash, infinite loop or heap overflow
https://notcve.org/view.php?id=CVE-2008-1419
16 May 2008 — Xiph.org libvorbis 1.2.0 and earlier does not properly handle a zero value for codebook.dim, which allows remote attackers to cause a denial of service (crash or infinite loop) or trigger an integer overflow. Xiph.org libvorbis 1.2.0 y versiones anteriores no maneja apropiadamente un valor cero de codebook.dim, lo cual permite a atacantes remotos provocar una denegación de servicio (caída o bucle infinito) o disparar un desbordamiento de entero. • http://lists.opensuse.org/opensuse-security-announce/2008-06/msg00001.html • CWE-20: Improper Input Validation CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 9.8EPSS: 4%CPEs: 7EXPL: 0CVE-2008-2009 – vorbis: insufficient validation of Huffman tree causing memory corruption in _make_decode_tree()
https://notcve.org/view.php?id=CVE-2008-2009
16 May 2008 — Xiph.org libvorbis before 1.0 does not properly check for underpopulated Huffman trees, which allows remote attackers to cause a denial of service (crash) via a crafted OGG file that triggers memory corruption during execution of the _make_decode_tree function. Xiph.org libvorbis versiones anteriores a 1.0 no comprueba apropiadamente para árboles poco poblados Huffman, lo cual permite a atacantes remotos provocar una denegación de servicio (caída) a través de ficheros OGG manipulados que disparan una corrup... • http://secunia.com/advisories/30247 •
CVSS: 8.8EPSS: 6%CPEs: 14EXPL: 0CVE-2008-1420 – vorbis: integer overflow in partvals computation
https://notcve.org/view.php?id=CVE-2008-1420
16 May 2008 — Integer overflow in residue partition value (aka partvals) evaluation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to execute arbitrary code via a crafted OGG file, which triggers a heap overflow. Desbordamiento de entero en la evaluación de valores en la partición de residuos (también conocido como partvals) en Xiph.org libvorbis 1.2.0 y versiones anteriores permite a atacantes remotos ejecutar código de su elección a través de ficheros OGG manipulados, lo cual dispara un desbordamiento ... • http://lists.opensuse.org/opensuse-security-announce/2008-06/msg00001.html • CWE-189: Numeric Errors CWE-190: Integer Overflow or Wraparound •
CVSS: 9.3EPSS: 6%CPEs: 13EXPL: 0CVE-2008-1423 – vorbis: integer oveflow caused by huge codebooks
https://notcve.org/view.php?id=CVE-2008-1423
16 May 2008 — Integer overflow in a certain quantvals and quantlist calculation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted OGG file with a large virtual space for its codebook, which triggers a heap overflow. Desbordamiento de entero en ciertos cálculos quantvals y quantlist de Xiph.org libvorbis 1.2.0 y versiones anteriores permite a atacantes remotos provocar una denegación de servicio (caída) o ejecutar código de su elecc... • http://lists.opensuse.org/opensuse-security-announce/2008-06/msg00001.html • CWE-122: Heap-based Buffer Overflow CWE-189: Numeric Errors •
CVSS: 9.8EPSS: 6%CPEs: 40EXPL: 0CVE-2008-1686 – libfishsound: insufficient boundary checks
https://notcve.org/view.php?id=CVE-2008-1686
08 Apr 2008 — Array index vulnerability in Speex 1.1.12 and earlier, as used in libfishsound 0.9.0 and earlier, including Illiminable DirectShow Filters and Annodex Plugins for Firefox, xine-lib before 1.1.12, and many other products, allows remote attackers to execute arbitrary code via a header structure containing a negative offset, which is used to dereference a function pointer. Una vulnerabilidad de índice de matriz en Speex versión 1.1.12 y anteriores, tal y como es usado en libfishsound versión 0.9.0 y anteriores... • http://blog.kfish.org/2008/04/release-libfishsound-091.html • CWE-189: Numeric Errors •
CVSS: 6.5EPSS: 5%CPEs: 1EXPL: 0CVE-2007-4065 – Multiple libvorbis flaws (CVE-2007-4066, CVE-2007-4029)
https://notcve.org/view.php?id=CVE-2007-4065
21 Sep 2007 — lib/vorbisfile.c in libvorbisfile in Xiph.Org libvorbis before 1.2.0 allows context-dependent attackers to cause a denial of service (infinite loop) via a crafted OGG file, aka trac Changeset 13217. lib/vorbisfile.c en libvorbisfile en Xiph.Org libvorbis anterior a 1.2.0 permite a atacantes dependientes del contexto provocar denegación de servicio (bucle infinito) a través de un archivo OGG, también conocido como trac Changeset 13217. • http://secunia.com/advisories/24923 •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2007-4066 – Multiple libvorbis flaws (CVE-2007-4066, CVE-2007-4029)
https://notcve.org/view.php?id=CVE-2007-4066
21 Sep 2007 — Multiple buffer overflows in Xiph.Org libvorbis before 1.2.0 allow context-dependent attackers to cause a denial of service or have other unspecified impact via a crafted OGG file, aka trac Changesets 13162, 13168, 13169, 13170, 13172, 13211, and 13215, as demonstrated by an overflow in oggenc.exe related to the _psy_noiseguards_8 array. Múltiples desbordamientos de búfer Xiph.Org libvorbis versiones anteriores a 1.2.0 permiten a atacantes locales o remotos dependientes del contexto provocar una denegación ... • http://secunia.com/advisories/24923 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 5%CPEs: 6EXPL: 0CVE-2007-1344
https://notcve.org/view.php?id=CVE-2007-1344
08 Mar 2007 — Multiple buffer overflows in src/ezstream.c in Ezstream before 0.3.0 allow remote attackers to execute arbitrary code via a crafted XML configuration file processed by the (1) urlParse function, which causes a stack-based overflow and the (2) ReplaceString function, which causes a heap-based overflow. NOTE: some of these details are obtained from third party information. Múltiples desbordamientos de búfer en el src/ezstream.c del Ezstream before 0.3.0 permiten a atacantes remotos ejecutar código de su elecc... • http://osvdb.org/33869 •