RHSA-2007:0845: Important: libvorbis security update
The libvorbis package contains runtime libraries for use in programs thatsupport Ogg Voribs. Ogg Vorbis is a fully open, non-proprietary, patent-androyalty-free, general-purpose compressed audio format.Several flaws were found in the way libvorbis processed audio data. Anattacker could create a carefully crafted OGG audio file in such a way thatit could cause an application linked with libvorbis to crash or executearbitrary code when it was opened. (CVE-2007-3106, CVE-2007-4029,CVE-2007-4065, CVE-2007-4066)Users of libvorbis are advised to upgrade to this updated package, whichcontains backported patches that resolve these issues.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2007:0845?
The severity of RHSA-2007:0845 is classified as important.
How do I fix RHSA-2007:0845?
To fix RHSA-2007:0845, update the libvorbis and libvorbis-devel packages to version 1.1.2-3.el5.0 or later.
What vulnerabilities are addressed by RHSA-2007:0845?
RHSA-2007:0845 addresses multiple flaws that affect the processing of audio data in libvorbis.
Which systems are affected by RHSA-2007:0845?
RHSA-2007:0845 affects Red Hat Enterprise Linux 4 and 5 systems with specific versions of libvorbis and libvorbis-devel.
Are there known exploits for RHSA-2007:0845?
There are no widely known exploits for the vulnerabilities addressed in RHSA-2007:0845 at this time.