The bark_noise_hybridmp function in psy.c in Xiph.Org libvorbis 1.3.5 allows remote attackers to cause a denial of service (out-of-bounds access and application crash) or possibly have unspecified other impact via a crafted mp4 file.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libvorbis | Nov 24, 2017 | Sep 21, 2017 |
| Debian | — | Upgrade libvorbis | Nov 29, 2019 | Sep 21, 2017 |
| Freebsd | — | Upgrade libvorbis | Jun 29, 2020 | Jun 28, 2020 |
| Gentoo Linux | — | Upgrade media-libs/libvorbis. | Mar 17, 2020 | Sep 21, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade libvorbis | Jan 19, 2018 | Sep 21, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade libvorbis | Jan 19, 2018 | Sep 21, 2017 |
| Huawei Euleros 2_0_sp3 | — | Upgrade libvorbis | Sep 28, 2020 | Sep 21, 2017 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libvorbis | Aug 10, 2021 | Sep 21, 2017 |
| Huawei Euleros 2_0_sp9 | — | Upgrade libvorbis-helpUpgrade libvorbis | Aug 10, 2021 | Sep 21, 2017 |
| Oracle Solaris | — | Upgrade codec/ogg-vorbis to version 2.30.0-0.175.3.35.0.3.0 on Solaris 11.3 | Aug 24, 2018 | Sep 21, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 21, 2017 |
| Suse | — | Upgrade libvorbisfile3Upgrade libvorbis-32bitUpgrade libvorbis0-32bitUpgrade libvorbis-x86Upgrade libvorbisfile3-32bitUpgrade libvorbisenc2-32bitUpgrade libvorbis-develUpgrade libvorbisenc2Upgrade libvorbisUpgrade libvorbis-docUpgrade libvorbis0 | May 17, 2018 | Sep 21, 2017 |
| Ubuntu | — | Upgrade libvorbisenc2 (Ubuntu Pro)Upgrade libvorbis0a (Ubuntu Pro)Upgrade libvorbisfile3 (Ubuntu Pro) | May 13, 2022 | Sep 21, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub