The bark_noise_hybridmp function in psy.c in Xiph.Org libvorbis 1.3.5 allows remote attackers to cause a denial of service (out-of-bounds access and application crash) or possibly have unspecified other impact via a crafted mp4 file.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libvorbis | Nov 24, 2017 | Sep 21, 2017 |
| Debian | — | Upgrade libvorbis | Nov 29, 2019 | Sep 21, 2017 |
| Freebsd | — | Upgrade libvorbis | Jun 29, 2020 | Jun 28, 2020 |
| Gentoo Linux | — | Upgrade media-libs/libvorbis. | Mar 17, 2020 | Sep 21, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade libvorbis | Jan 19, 2018 | Sep 21, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade libvorbis | Jan 19, 2018 | Sep 21, 2017 |
| Huawei Euleros 2_0_sp3 | — | Upgrade libvorbis | Sep 28, 2020 | Sep 21, 2017 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libvorbis | Aug 10, 2021 | Sep 21, 2017 |
| Huawei Euleros 2_0_sp9 | — | Upgrade libvorbis-helpUpgrade libvorbis | Aug 10, 2021 | Sep 21, 2017 |
| Oracle Solaris | — | Upgrade codec/ogg-vorbis to version 2.30.0-0.175.3.35.0.3.0 on Solaris 11.3 | Aug 24, 2018 | Sep 21, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 21, 2017 |
| Suse | — | Upgrade libvorbis-develUpgrade libvorbisenc2Upgrade libvorbisenc2-32bitUpgrade libvorbisUpgrade libvorbis-docUpgrade libvorbis0Upgrade libvorbis-32bitUpgrade libvorbisfile3Upgrade libvorbis-x86Upgrade libvorbis0-32bitUpgrade libvorbisfile3-32bit | May 17, 2018 | Sep 21, 2017 |
| Ubuntu | — | Upgrade libvorbis0a (Ubuntu Pro)Upgrade libvorbisenc2 (Ubuntu Pro)Upgrade libvorbisfile3 (Ubuntu Pro) | May 13, 2022 | Sep 21, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub