National Cyber Awareness System

Vulnerability Summary for CVE-2008-1423

Overview

Integer overflow in a certain quantvals and quantlist calculation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted OGG file with a large virtual space for its codebook, which triggers a heap overflow.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=440709

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=440709

External Source: XF

Name: libvorbis-quantvals-quantlist-bo(42403)

Hyperlink:http://xforce.iss.net/xforce/xfdb/42403

External Source: VUPEN

Name: ADV-2008-1510

Hyperlink:http://www.vupen.com/english/advisories/2008/1510/references

External Source: UBUNTU

Name: USN-682-1

Hyperlink:http://www.ubuntu.com/usn/USN-682-1

External Source: GENTOO

Name: GLSA-200806-09

Hyperlink:http://security.gentoo.org/glsa/glsa-200806-09.xml

External Source: SECUNIA

Name: 32946

Hyperlink:http://secunia.com/advisories/32946

External Source: SECUNIA

Name: 30820

Hyperlink:http://secunia.com/advisories/30820

External Source: SECUNIA

Name: 30581

Hyperlink:http://secunia.com/advisories/30581

External Source: OVAL

Name: oval:org.mitre.oval:def:9851

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9851

External Source: FEDORA

Name: FEDORA-2008-3910

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00256.html

External Source: FEDORA

Name: FEDORA-2008-3898

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00247.html

External Source: FEDORA

Name: FEDORA-2008-3934

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00243.html

External Source: SECTRACK

Name: 1020029

Hyperlink:http://www.securitytracker.com/id?1020029

External Source: BID

Name: 29206

Hyperlink:http://www.securityfocus.com/bid/29206

External Source: REDHAT

Name: RHSA-2008:0271

Hyperlink:http://www.redhat.com/support/errata/RHSA-2008-0271.html

External Source: REDHAT

Name: RHSA-2008:0270

Hyperlink:http://www.redhat.com/support/errata/RHSA-2008-0270.html

External Source: MANDRIVA

Name: MDVSA-2008:102

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2008:102

External Source: DEBIAN

Name: DSA-1591

Hyperlink:http://www.debian.org/security/2008/dsa-1591

External Source: SECUNIA

Name: 30479

Hyperlink:http://secunia.com/advisories/30479

External Source: SECUNIA

Name: 30259

Hyperlink:http://secunia.com/advisories/30259

External Source: SECUNIA

Name: 30247

Hyperlink:http://secunia.com/advisories/30247

External Source: SECUNIA

Name: 30237

Hyperlink:http://secunia.com/advisories/30237

External Source: SECUNIA

Name: 30234

Hyperlink:http://secunia.com/advisories/30234

External Source: SUSE

Name: SUSE-SR:2008:012

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2008-06/msg00001.html

References to Check Content

Identifier:oval:org.mitre.oval:def:9851

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:9851