Buffer Overflow vulnerability in Vorbis-tools v.1.4.2 allows a local attacker to execute arbitrary code and cause a denial of service during the conversion of wav files to ogg files.

https://github.com/xiph/vorbis-tools https://github.com/xiph/vorbis-tools/issues/41 https://github.com/xiph/vorbis https://xiph.org/vorbis/

Buffer Overflow vulnerability in Vorbis-tools v.1.4.2 allows a local attacker to execute arbitrary code and cause a denial of service during the conversion of wav files to ogg files.

A buffer overflow flaw was found in the way the oggenc utility, which is used to encode audio into the Ogg Vorbis format, handled invalid AIFF files. An attacker could provide a specially crafted AIFF file that would crash oggenc when processed.

Upstream bug with a patch:

https://trac.xiph.org/ticket/2212