CVE-2015-6749: Buffer Overflow
A buffer overflow flaw was found in the way the oggenc utility, which is used to encode audio into the Ogg Vorbis format, handled invalid AIFF files. An attacker could provide a specially crafted AIFF file that would crash oggenc when processed.
Upstream bug with a patch:
https://trac.xiph.org/ticket/2212
Other sources
Buffer overflow in the aiffopen function in oggenc/audio.c in vorbis-tools 1.4.0 and earlier allows remote attackers to cause a denial of service (crash) via a crafted AIFF file.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-6749?
CVE-2015-6749 has a medium severity rating due to the potential for a buffer overflow leading to application crashes.
How do I fix CVE-2015-6749?
To fix CVE-2015-6749, update vorbis-tools to version 1.4.1 or higher.
What software is affected by CVE-2015-6749?
CVE-2015-6749 affects vorbis-tools versions up to and including 1.4.0.
What type of flaw is CVE-2015-6749?
CVE-2015-6749 is a buffer overflow flaw that occurs when handling invalid AIFF files.
Can CVE-2015-6749 be exploited remotely?
Yes, CVE-2015-6749 can be exploited remotely if an attacker provides a specially crafted AIFF file.