Arch Linux Security Advisory ASA-201510-22 ========================================== Severity: Low Date : 2015-10-27 CVE-ID : CVE-2015-6749 Package : vorbis-tools Type : denial of service Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package vorbis-tools before version 1.4.0-6 is vulnerable to denial of service. Resolution ========== Upgrade to 1.4.0-6. # pacman -Syu "vorbis-tools>=1.4.0-6" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== Buffer overflow in the aiff_open function in oggenc/audio.c allows local attackers to cause a denial of service (crash) via a crafted AIFF file. Impact ====== A local attacker is able to craft a special AIFF file that crashes the application leading to denial of service. References ========== https://access.redhat.com/security/cve/CVE-2015-6749 https://trac.xiph.org/ticket/2212 https://bugs.archlinux.org/task/46269