mapping0_forward in mapping0.c in Xiph.Org libvorbis 1.3.6 does not validate the number of channels, which allows remote attackers to cause a denial of service (heap-based buffer overflow or over-read) or possibly have unspecified other impact via a crafted file.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libvorbis-develUpgrade libvorbisUpgrade libvorbis-devel-docs | May 4, 2022 | Apr 26, 2018 |
| Alpine Linux | — | Upgrade libvorbis | Jul 31, 2018 | Apr 26, 2018 |
| Centos_linux | — | Upgrade libvorbisUpgrade libvorbis-debugsourceUpgrade libvorbis-debuginfo | Nov 6, 2019 | Apr 26, 2018 |
| Debian | — | Upgrade libvorbis | Nov 29, 2019 | Apr 26, 2018 |
| Freebsd | — | Upgrade libvorbis | Jun 29, 2020 | Jun 28, 2020 |
| Gentoo Linux | — | Upgrade media-libs/libvorbis. | Mar 17, 2020 | Apr 26, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade libvorbis | Nov 3, 2020 | Apr 26, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade libvorbis | Sep 28, 2020 | Apr 26, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade libvorbis | Sep 3, 2020 | Apr 26, 2018 |
| Oracle Solaris | — | Upgrade codec/ogg-vorbis to version 2.30.0-0.175.3.35.0.3.0 on Solaris 11.3 | Aug 24, 2018 | Apr 26, 2018 |
| Oracle_linux | — | Upgrade libvorbis-develUpgrade libvorbis-devel-docsUpgrade libvorbis | Oct 5, 2022 | Apr 25, 2018 |
| Redhat_linux | — | Upgrade libvorbis-debugsourceNo solution existsUpgrade libvorbis-debuginfoUpgrade libvorbis-develUpgrade libvorbis-devel-docsUpgrade libvorbis | Nov 6, 2019 | Apr 26, 2018 |
| Rocky_linux | — | Upgrade libvorbis-develUpgrade libvorbis-debugsourceUpgrade libvorbisUpgrade libvorbis-debuginfo | Mar 12, 2024 | Apr 26, 2018 |
| Suse | — | Upgrade libvorbisfile3Upgrade libvorbis-devel-32bitUpgrade libvorbisenc2-32bitUpgrade libvorbis-docUpgrade libvorbis0Upgrade libvorbis0-32bitUpgrade libvorbisUpgrade libvorbis-develUpgrade libvorbisenc2Upgrade libvorbisfile3-32bitUpgrade libvorbis-32bitUpgrade libvorbis-x86 | Jun 7, 2018 | Apr 26, 2018 |
| Ubuntu | — | Upgrade libvorbis0a (Ubuntu Pro)Upgrade libvorbisenc2 (Ubuntu Pro)Upgrade libvorbisfile3 (Ubuntu Pro) | May 13, 2022 | Apr 26, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub