CVE-2018-10392
mapping0_forward in mapping0.c in Xiph.Org libvorbis 1.3.6 does not validate the number of channels, which allows remote attackers to cause a denial of service (heap-based buffer overflow or over-read) or possibly have unspecified other impact via a crafted file.
- Score
- CVSS 3.1 8.8 High
- Status
- Modified - cve@mitre.org
- Published
- 2018-04-26
- Last modified
- 2024-08-05
- Weaknesses
- CWE-125, CWE-787
Affected products
- Debian Linux (Debian)
- Enterprise Linux (Redhat)
- Enterprise Linux Eus (Redhat)
- Enterprise Linux Server Aus (Redhat)
- Enterprise Linux Server Tus (Redhat)
- Libvorbis (Xiph.org)
References
- https://access.redhat.com/errata/RHSA-2019:3703
- https://gitlab.xiph.org/xiph/vorbis/issues/2335
- https://lists.debian.org/debian-lts-announce/2019/11/msg00031.html
- https://lists.debian.org/debian-lts-announce/2021/11/msg00023.html
- https://security.gentoo.org/glsa/202003-36
