REDHAT-BUG-245991: High severity xiph libvorbis vulnerability
Chris Montgomery has informed us of a bug found in libvorbis. The patch is in revision 13160 from http://svn.xiph.org/trunk/vorbis (svn diff -r 13159:13160 http://svn.xiph.org/trunk/vorbis)
I'm calling this bug an "array boundary condition flaw". It's the best definition I could find that matched up with something MITRE uses. The issue in question is related to the usage of a function pointer table. Here is an example:
mappingP[ci->maptype[i]]->freeinfo(ci->mapparam[i]);
What happens is the value of 'ci->maptype[i]' can be an attacker controlled 16 bit unsigned integer. The amount of play with the that function pointer is a bit suspect I admit, but I suspect it's still exploitable (some peer review from someone better at this sort of thing would be helpful).
The code in question is called when libvorbis starts to clean things up after receiving bad data.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-245991?
The severity of REDHAT-BUG-245991 has not been explicitly classified but it is important to address the bug in libvorbis due to potential security implications.
How do I fix REDHAT-BUG-245991?
To fix REDHAT-BUG-245991, you should update to the latest version of libvorbis where the bug has been patched.
What software is affected by REDHAT-BUG-245991?
Xiph libvorbis is the affected software identified in REDHAT-BUG-245991.
Who reported the vulnerability REDHAT-BUG-245991?
The vulnerability REDHAT-BUG-245991 was reported by Chris Montgomery.
What is the nature of the bug in REDHAT-BUG-245991?
The nature of the bug in REDHAT-BUG-245991 is related to libvorbis, which may introduce security vulnerabilities or instability.