Note:
This project will be discontinued after December 13, 2021. [more]
2017-10-09
plugins/ogg.c in Libmp3splt 0.9.2 calls the libvorbis vorbis_block_clear function with uninitialized data upon detection of invalid input, which allows remote attackers to cause a denial of service (application crash) via a crafted file.
| Products | Libmp3splt |
| Type | Improper Input Validation (CWE-20) |
| First patch | - None (likely due to unavailable code) |
| Links |
• https://lists.debian.org/debian-lts/2017/09/msg00115.html
• https://anonscm.debian.org/cgit/users/ron/mp3splt.git/commit/?id=18f018cd774cb931116ce06a520dc0c5f9443932 • http://seclists.org/fulldisclosure/2017/Jul/82 • https://www.exploit-db.com/exploits/42399/ |