Lucene search

DebianDEBIAN:DLA-2013-1:5C4F6

HistoryNov 27, 2019 - 9:39 p.m.

[SECURITY] [DLA 2013-1] libvorbis security update

2019-11-2721:39:56

lists.debian.org

125

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.012

Percentile

85.1%

JSON

Package : libvorbis
Version : 1.3.4-2+deb8u2
CVE ID : CVE-2017-14160 CVE-2018-10392 CVE-2018-10393

Several issues have been found in libvorbis, a decoder library for Vorbis
General Audio Compression Codec.

The fix for CVE-2017-14160 and CVE-2018-10393 improve the bound checking
for very low sample rates.

CVE-2018-10392 was found because the number of channels was not validated
and a remote attacker could cause a denial of service.

For Debian 8 "Jessie", these problems have been fixed in version
1.3.4-2+deb8u2.

We recommend that you upgrade your libvorbis packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian8i386libvorbis-dev< 1.3.4-2+deb8u2libvorbis-dev_1.3.4-2+deb8u2_i386.deb
Debian8alllibvorbis< 1.3.4-2+deb8u2libvorbis_1.3.4-2+deb8u2_all.deb
Debian8armhflibvorbisfile3< 1.3.4-2+deb8u2libvorbisfile3_1.3.4-2+deb8u2_armhf.deb
Debian8amd64libvorbis-dbg< 1.3.4-2+deb8u2libvorbis-dbg_1.3.4-2+deb8u2_amd64.deb
Debian8armellibvorbis-dbg< 1.3.4-2+deb8u2libvorbis-dbg_1.3.4-2+deb8u2_armel.deb
Debian9i386libvorbis-dev< 1.3.5-4+deb9u3libvorbis-dev_1.3.5-4+deb9u3_i386.deb
Debian8i386libvorbis0a< 1.3.4-2+deb8u2libvorbis0a_1.3.4-2+deb8u2_i386.deb
Debian9i386libvorbis0a< 1.3.5-4+deb9u3libvorbis0a_1.3.5-4+deb9u3_i386.deb
Debian9arm64libvorbisfile3< 1.3.5-4+deb9u3libvorbisfile3_1.3.5-4+deb9u3_arm64.deb
Debian8armhflibvorbis-dev< 1.3.4-2+deb8u2libvorbis-dev_1.3.4-2+deb8u2_armhf.deb

OS	Version	Architecture	Package	Version	Filename
Debian	8	i386	libvorbis-dev	< 1.3.4-2+deb8u2	libvorbis-dev_1.3.4-2+deb8u2_i386.deb
Debian	8	all	libvorbis	< 1.3.4-2+deb8u2	libvorbis_1.3.4-2+deb8u2_all.deb
Debian	8	armhf	libvorbisfile3	< 1.3.4-2+deb8u2	libvorbisfile3_1.3.4-2+deb8u2_armhf.deb
Debian	8	amd64	libvorbis-dbg	< 1.3.4-2+deb8u2	libvorbis-dbg_1.3.4-2+deb8u2_amd64.deb
Debian	8	armel	libvorbis-dbg	< 1.3.4-2+deb8u2	libvorbis-dbg_1.3.4-2+deb8u2_armel.deb
Debian	9	i386	libvorbis-dev	< 1.3.5-4+deb9u3	libvorbis-dev_1.3.5-4+deb9u3_i386.deb
Debian	8	i386	libvorbis0a	< 1.3.4-2+deb8u2	libvorbis0a_1.3.4-2+deb8u2_i386.deb
Debian	9	i386	libvorbis0a	< 1.3.5-4+deb9u3	libvorbis0a_1.3.5-4+deb9u3_i386.deb
Debian	9	arm64	libvorbisfile3	< 1.3.5-4+deb9u3	libvorbisfile3_1.3.5-4+deb9u3_arm64.deb
Debian	8	armhf	libvorbis-dev	< 1.3.4-2+deb8u2	libvorbis-dev_1.3.4-2+deb8u2_armhf.deb