[ASA-201803-21] lib32-libvorbis: multiple issues
anthraxx at archlinux.org
Thu Mar 22 01:52:32 UTC 2018
Arch Linux Security Advisory ASA-201803-21
Date : 2018-03-19
CVE-ID : CVE-2017-14632 CVE-2017-14633 CVE-2018-5146
Package : lib32-libvorbis
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-658
The package lib32-libvorbis before version 1.3.6-1 is vulnerable to
multiple issues including arbitrary code execution and denial of
Upgrade to 1.3.6-1.
# pacman -Syu "lib32-libvorbis>=1.3.6-1"
The problems have been fixed upstream in version 1.3.6.
- CVE-2017-14632 (arbitrary code execution)
fXiph.Org libvorbis before 1.3.6 allows remote code execution upon
freeing uninitialized memory in the function
vorbis_analysis_headerout() in info.c when vi->channels<=0, a similar
issue to Mozilla bug 550184.
- CVE-2017-14633 (denial of service)
In Xiph.Org libvorbis before 1.3.6, an out-of-bounds array read
vulnerability exists in the function mapping0_forward() in mapping0.c,
which may lead to DoS when operating on a crafted audio file with
- CVE-2018-5146 (arbitrary code execution)
An out of bounds memory write vulnerability has been discovered in
libvorbis before 1.3.6 while processing Vorbis audio data related to
codebooks that are not an exact divisor of the partition size.
A remote attacker is able to execute arbitrary code or crash the
application by tricking the user into playing a specially crafted
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 866 bytes
Desc: OpenPGP digital signature
More information about the arch-security