CVE-2018-10392: Buffer Overflow
A flaw was found in libvorbis 1.3.6. The mapping0forward function in mapping0.c file in Xiph.Org does not validate the number of channels, which allows remote attackers to cause a denial of service (heap-based buffer overflow or over-read) via a crafted file.
References: https://gitlab.xiph.org/xiph/vorbis/issues/2335
Other sources
mapping0forward in mapping0.c in Xiph.Org libvorbis 1.3.6 does not validate the number of channels, which allows remote attackers to cause a denial of service (heap-based buffer overflow or over-read) or possibly have unspecified other impact via a crafted file.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-10392?
CVE-2018-10392 has been classified with a severity that allows for potential denial of service through heap-based buffer overflow or over-read.
How do I fix CVE-2018-10392?
To fix CVE-2018-10392, upgrade to a patched version of libvorbis that addresses the vulnerability.
Which versions of libvorbis are affected by CVE-2018-10392?
CVE-2018-10392 specifically affects libvorbis version 1.3.6 due to improper channel validation.
Can CVE-2018-10392 be exploited remotely?
Yes, CVE-2018-10392 can be exploited remotely by sending a crafted file to trigger the vulnerability.
Is CVE-2018-10392 present on Debian or Red Hat systems?
Yes, CVE-2018-10392 is present on Debian 8.0, 9.0 and various Red Hat Enterprise Linux versions including 8.0 through 8.4.