REDHAT-BUG-444443: High severity libvorbisfile vulnerability
Will Drewry of the Google Security Team created a set of fuzzed OGG test files to test OGG Vorbis and Tremor implementations. Some of them were causing memory corruption and crash on old libvorbis versions (prior to 1.0).
Crash / corruption occurred in makedecodetree(). This function was removed prior to the release of upstream version 1.0 in following changes:
https://trac.xiph.org/changeset/2959 https://trac.xiph.org/changeset/2960
Test files do not crash libvobis revision 2960 or later.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-444443?
The severity of REDHAT-BUG-444443 is critical due to the potential for memory corruption and application crashes.
How do I fix REDHAT-BUG-444443?
To fix REDHAT-BUG-444443, update to a version of libvorbis that is 1.0 or higher.
What software is affected by REDHAT-BUG-444443?
REDHAT-BUG-444443 affects all versions of Xiph.org libvorbis prior to 1.0.
What vulnerabilities does REDHAT-BUG-444443 expose?
REDHAT-BUG-444443 exposes vulnerabilities to memory corruption and crashing during the decoding process.
Who reported the issue related to REDHAT-BUG-444443?
The issue related to REDHAT-BUG-444443 was reported by Will Drewry from the Google Security Team.