CVE-2008-1423: Integer Overflow
Integer overflow in a certain quantvals and quantlist calculation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted OGG file with a large virtual space for its codebook, which triggers a heap overflow.
Other sources
Will Drewry of the Google Security Team reported an issue in OGG Vorbis library, that can cause an integer overflow in the computation of quantvals and of the space required for quantlist leading to a heap overflow.
Check for the overflow added in the fix. Files are rejected if the total virtual space of the codebook exceeds 24 bits.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-1423?
CVE-2008-1423 has a high severity as it allows remote attackers to cause denial of service or potentially execute arbitrary code.
How do I fix CVE-2008-1423?
To fix CVE-2008-1423, update the libvorbis library to version 1.2.1 or later.
What software is affected by CVE-2008-1423?
CVE-2008-1423 affects libvorbis versions 1.2.0 and earlier.
Can CVE-2008-1423 lead to data breaches?
Yes, CVE-2008-1423 can potentially lead to data breaches due to arbitrary code execution vulnerability.
Is CVE-2008-1423 related to OGG file handling?
Yes, CVE-2008-1423 is specifically related to how crafted OGG files are handled in the libvorbis library.