CVE-2014-9638: Medium severity Fedoraproject Fedora vulnerability
Published Jan 23, 2015
·Updated
oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (divide-by-zero error and crash) via a WAV file with the number of channels set to zero.
Affected Software
7 affected componentsFixes available
debian/opus-tools
0.1.10-10.2-1
debian/vorbis-tools
1.4.0-111.4.2-11.4.2-2
Fedoraproject Fedora=20
Fedoraproject Fedora=21
openSUSE openSUSE=13.1
openSUSE openSUSE=13.2
xiph vorbis-tools=1.4.0
Event History
Jan 23, 2015
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-9638?
CVE-2014-9638 has a high severity rating as it allows remote attackers to cause a denial of service.
2
How do I fix CVE-2014-9638?
To fix CVE-2014-9638, upgrade to a patched version of vorbis-tools, specifically versions after 1.4.0-11.
3
What types of systems are affected by CVE-2014-9638?
CVE-2014-9638 affects systems running vorbis-tools versions 1.4.0 and earlier, including specific Debian and Fedora releases.
4
What attack vector does CVE-2014-9638 utilize?
CVE-2014-9638 is exploited through the processing of WAV files with an invalid number of channels.
5
Are there any known exploits for CVE-2014-9638?
While specific exploits for CVE-2014-9638 have not been publicly documented, the vulnerability represents a clear denial-of-service risk.