A flaw was found in libtheora. This heap-based out-of-bounds read vulnerability exists within the AVI (Audio Video Interleave) parser, specifically in the aviparseinputfile() function. A local attacker could exploit this by tricking a user into opening a specially crafted AVI file containing a truncated header sub-chunk. This could lead to a denial-of-service (application crash) or potentially leak sensitive information from the heap.

Severity:  - moderate

Affected versions: - libtheora through 1.2.0

Fixed software: - v1.2.0

Description: A flaw was found in Theora (libtheora). An incorrect bitwise shift may be triggered via specially-crafted input, potentially resulting in an application crash.

------------------------------------------------------------- References: https://github.com/advisories/GHSA-8xp8-gmmj-xc8w https://github.com/UnionTech-Software/openfhe-PoC https://gitlab.xiph.org/xiph/theora/-/mergerequests/28 https://gitlab.xiph.org/xiph/theora/-/commit/5665f86b8fd8345bb09469990e79221562ac204b

ochufftreeunpack in huffdec.c in libtheora in Theora through 1.0 7180717 has an invalid negative left shift. NOTE: this is disputed by third parties because there is no evidence of a security impact, e.g., an application would not crash.

Buffer Overflow vulnerability in Vorbis-tools v.1.4.2 allows a local attacker to execute arbitrary code and cause a denial of service during the conversion of wav files to ogg files.

https://github.com/xiph/vorbis-tools https://github.com/xiph/vorbis-tools/issues/41 https://github.com/xiph/vorbis https://xiph.org/vorbis/

Buffer Overflow vulnerability in Vorbis-tools v.1.4.2 allows a local attacker to execute arbitrary code and cause a denial of service during the conversion of wav files to ogg files.

A null pointer dereference issue was discovered in functions opgetdata and opopen1 in opusfile.c in xiph opusfile 0.9 thru 0.12 allows attackers to cause denial of service or other unspecified impacts.

DISPUTED A stack buffer overflow in speexenc.c of Speex v1.2 allows attackers to cause a denial of service (DoS) via a crafted WAV file. NOTE: the vendor states "I cannot reproduce it" and it "is a demo program."

A Divide by Zero vulnerability in the function static int readsamples of Speex v1.2 allows attackers to cause a denial of service (DoS) via a crafted WAV file.

A buffer overflow was discovered in the URL-authentication backend of the Icecast before 2.4.4. If the backend is enabled, then any malicious HTTP client can send a request for that specific resource including a crafted header, leading to denial of service and potentially remote code execution.

A flaw was found in libvorbis 1.3.6. The mapping0forward function in mapping0.c file in Xiph.Org does not validate the number of channels, which allows remote attackers to cause a denial of service (heap-based buffer overflow or over-read) via a crafted file.

References: https://gitlab.xiph.org/xiph/vorbis/issues/2335

The tokenizematrix function in audioout.c in Xiph.Org libao 1.2.0 allows remote attackers to cause a denial of service

The wavopen function in oggenc/audio.c in Xiph.Org vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (memory allocation error) via a crafted wav file.

A buffer overflow flaw was found in the way the oggenc utility, which is used to encode audio into the Ogg Vorbis format, handled invalid AIFF files. An attacker could provide a specially crafted AIFF file that would crash oggenc when processed.

Upstream bug with a patch:

https://trac.xiph.org/ticket/2212

A buffer overflow flaw was found in the way the oggenc utility, which is used to encode audio into the Ogg Vorbis format, handled invalid AIFF files. An attacker could provide a specially crafted AIFF file that would crash oggenc when processed.

Upstream bug with a patch:

https://trac.xiph.org/ticket/2212

Icecast before 2.4.2, when a streamauth handler is defined for URL authentication, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a request without login credentials, as demonstrated by a request to "admin/killsource?mount=/test.ogg."

Integer overflow in oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (crash) via a crafted number of channels in a WAV file, which triggers an out-of-bounds memory access.

oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (divide-by-zero error and crash) via a WAV file with the number of channels set to zero.

oggenc/oggenc.c in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted raw file.

icecast before 2.3.3 allows remote attackers to inject control characters such as newlines into the error loc (error.log) via a crafted URL.

Array index vulnerability in Speex 1.1.12 and earlier, as used in libfishsound 0.9.0 and earlier, including Illiminable DirectShow Filters and Annodex Plugins for Firefox, xine-lib before 1.1.12, and many other products, allows remote attackers to execute arbitrary code via a header structure containing a negative offset, which is used to dereference a function pointer.

Will Drewry of the Google Security Team reported an issue in OGG Vorbis library, that can cause an integer overflow in the computation of quantvals and of the space required for quantlist leading to a heap overflow.

Check for the overflow added in the fix. Files are rejected if the total virtual space of the codebook exceeds 24 bits.

Chris Montgomery has informed us of a bug found in libvorbis. The patch is in revision 13160 from http://svn.xiph.org/trunk/vorbis (svn diff -r 13159:13160 http://svn.xiph.org/trunk/vorbis)

I'm calling this bug an "array boundary condition flaw". It's the best definition I could find that matched up with something MITRE uses. The issue in question is related to the usage of a function pointer table. Here is an example:

mappingP[ci->maptype[i]]->freeinfo(ci->mapparam[i]);

What happens is the value of 'ci->maptype[i]' can be an attacker controlled 16 bit unsigned integer. The amount of play with the that function pointer is a bit suspect I admit, but I suspect it's still exploitable (some peer review from someone better at this sort of thing would be helpful).

The code in question is called when libvorbis starts to clean things up after receiving bad data.

Multiple buffer overflows in src/ezstream.c in Ezstream before 0.3.0 allow remote attackers to execute arbitrary code via a crafted XML configuration file processed by the (1) urlParse function, which causes a stack-based overflow and the (2) ReplaceString function, which causes a heap-based overflow. NOTE: some of these details are obtained from third party information.