REDHAT-BUG-516259: Input Validation
An insufficient input validation flaw was found in the way libvorbis used to process codec file headers (static mode headers and encoding books) for the Ogg Vorbis audio file format (Ogg). A remote attacker could provide a specially-crafted Ogg file, which would lead to denial of service (memory corruption and application crash) or, potentially execute arbitrary code with the privileges of the application using the libvorbis library, when opened by the victim.
References: ----------- https://bugzilla.mozilla.org/showbug.cgi?id=500254 http://bugs.gentoo.org/280393 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-2663
Reproducer: ----------- https://bugzilla.mozilla.org/attachment.cgi?id=384979
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-516259?
The vulnerability REDHAT-BUG-516259 has the potential to cause a denial of service through specially crafted Ogg files.
How do I fix REDHAT-BUG-516259?
To fix REDHAT-BUG-516259, you should update to the latest version of the libvorbis package provided by your vendor.
What component is affected by REDHAT-BUG-516259?
The component affected by REDHAT-BUG-516259 is the libvorbis codec used for processing Ogg Vorbis audio files.
Who is the vendor for the software impacted by REDHAT-BUG-516259?
The vendor for the software impacted by REDHAT-BUG-516259 is Xiph.org.
What type of vulnerability is REDHAT-BUG-516259?
REDHAT-BUG-516259 is classified as an insufficient input validation vulnerability.