REDHAT-BUG-1574194: Low severity libvorbisfile vulnerability

Published May 2, 2018

Updated

A flaw was found in libvorbis 1.3.6. The barknoisehybridmp function in psy.c file in Xiph.Org has a stack-based buffer over-read which allows remote attackers to cause a denial of service via a crafted file.

References: https://gitlab.xiph.org/xiph/vorbis/issues/2334

Affected Software

1 affected component

Xiph.org libvorbis=1.3.6

Event History

May 2, 2018

Data Sourced

via Red Hat·07:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1574194?

The severity of REDHAT-BUG-1574194 is considered significant due to the potential for a denial of service caused by stack-based buffer over-read.

How do I fix REDHAT-BUG-1574194?

To fix REDHAT-BUG-1574194, update the libvorbis package to a version that includes the patch for the identified vulnerability.

What software is affected by REDHAT-BUG-1574194?

REDHAT-BUG-1574194 affects Xiph.Org libvorbis version 1.3.6.

How does REDHAT-BUG-1574194 impact users?

REDHAT-BUG-1574194 can impact users by causing applications relying on libvorbis to crash or become unresponsive when processing specially crafted files.

Who can exploit the vulnerability in REDHAT-BUG-1574194?

Remote attackers can exploit the vulnerability in REDHAT-BUG-1574194 by sending crafted files that trigger the stack-based buffer over-read.