Integer overflow in a certain quantvals and quantlist calculation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted OGG file with a large virtual space for its codebook, which triggers a heap overflow.

The barknoisehybridmp function in psy.c in Xiph.Org libvorbis 1.3.5 allows remote attackers to cause a denial of service (out-of-bounds access and application crash) or possibly have unspecified other impact via a crafted mp4 file.

A flaw was found in libvorbis 1.3.6. The mapping0forward function in mapping0.c file in Xiph.Org does not validate the number of channels, which allows remote attackers to cause a denial of service (heap-based buffer overflow or over-read) via a crafted file.

References: https://gitlab.xiph.org/xiph/vorbis/issues/2335

A flaw was found in libvorbis 1.3.6. The barknoisehybridmp function in psy.c file in Xiph.Org has a stack-based buffer over-read which allows remote attackers to cause a denial of service via a crafted file.

References: https://gitlab.xiph.org/xiph/vorbis/issues/2334

Will Drewry of the Google Security Team created a set of fuzzed OGG test files to test OGG Vorbis and Tremor implementations. Some of them were causing memory corruption and crash on old libvorbis versions (prior to 1.0).

Crash / corruption occurred in makedecodetree(). This function was removed prior to the release of upstream version 1.0 in following changes:

https://trac.xiph.org/changeset/2959 https://trac.xiph.org/changeset/2960

Test files do not crash libvobis revision 2960 or later.

An insufficient input validation flaw was found in the way libvorbis used to process codec file headers (static mode headers and encoding books) for the Ogg Vorbis audio file format (Ogg). A remote attacker could provide a specially-crafted Ogg file, which would lead to denial of service (memory corruption and application crash) or, potentially execute arbitrary code with the privileges of the application using the libvorbis library, when opened by the victim.

References: ----------- https://bugzilla.mozilla.org/showbug.cgi?id=500254 http://bugs.gentoo.org/280393 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-2663

Reproducer: ----------- https://bugzilla.mozilla.org/attachment.cgi?id=384979

Integer overflow in residue partition value (aka partvals) evaluation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to execute arbitrary code via a crafted OGG file, which triggers a heap overflow.

lib/codebook.c in libvorbis before 1.3.6, as used in StepMania 5.0.12 and other products, has insufficient array bounds checking via a crafted OGG file. NOTE: this may overlap CVE-2018-5146.

Will Drewry of the Google Security Team reported an issue in OGG Vorbis library, that can cause crash of the application using vorbis library, trigger an infinite loop, or cause an integer overflow leading to possible heap overflow.

Problem is caused by codebooks with codebook.dim == 0.

Will Drewry of the Google Security Team created a set of fuzzed OGG test files to test OGG Vorbis and Tremor implementations. Some of them were causing memory corruption and crash on old libvorbis versions (prior to 1.0).

Crash / corruption occurred in makedecodetree(). This function was removed prior to the release of upstream version 1.0 in following changes:

https://trac.xiph.org/changeset/2959 https://trac.xiph.org/changeset/2960

Test files do not crash libvobis revision 2960 or later.

A flaw was found in libvorbis 1.3.6. The barknoisehybridmp function in psy.c file in Xiph.Org has a stack-based buffer over-read which allows remote attackers to cause a denial of service via a crafted file.

References: https://gitlab.xiph.org/xiph/vorbis/issues/2334

The libvorbis package contains runtime libraries for use in programs thatsupport Ogg Voribs. Ogg Vorbis is a fully open, non-proprietary, patent-androyalty-free, general-purpose compressed audio format.Several flaws were found in the way libvorbis processed audio data. Anattacker could create a carefully crafted OGG audio file in such a way thatit could cause an application linked with libvorbis to crash or executearbitrary code when it was opened. (CVE-2007-3106, CVE-2007-4029,CVE-2007-4065, CVE-2007-4066)Users of libvorbis are advised to upgrade to this updated package, whichcontains backported patches that resolve these issues.