CVE-2008-2009: Medium severity libvorbisfile vulnerability
Will Drewry of the Google Security Team created a set of fuzzed OGG test files to test OGG Vorbis and Tremor implementations. Some of them were causing memory corruption and crash on old libvorbis versions (prior to 1.0).
Crash / corruption occurred in makedecodetree(). This function was removed prior to the release of upstream version 1.0 in following changes:
https://trac.xiph.org/changeset/2959 https://trac.xiph.org/changeset/2960
Test files do not crash libvobis revision 2960 or later.
Other sources
Xiph.org libvorbis before 1.0 does not properly check for underpopulated Huffman trees, which allows remote attackers to cause a denial of service (crash) via a crafted OGG file that triggers memory corruption during execution of the makedecodetree function.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-2009?
CVE-2008-2009 is considered a moderate severity vulnerability due to potential memory corruption leading to application crashes.
How do I fix CVE-2008-2009?
To fix CVE-2008-2009, upgrade to a version of libvorbis that is 1.0 or newer, as older versions are affected.
What software versions are affected by CVE-2008-2009?
CVE-2008-2009 affects libvorbis versions 1.0-beta4, 1.0-rc1, and 1.0-rc2, along with specific versions of Ubuntu Linux listed in the CVE.
What are the consequences of exploiting CVE-2008-2009?
Exploitation of CVE-2008-2009 can lead to memory corruption which may cause the application using libvorbis to crash.
Is CVE-2008-2009 still a concern today?
While CVE-2008-2009 primarily affects outdated versions of libvorbis, users of legacy systems should still be aware of its potential risks.