Bug 245991 - (CVE-2007-3106) CVE-2007-3106 libvorbis array boundary condition
CVE-2007-3106 libvorbis array boundary condition
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
All Linux
high Severity high
: ---
: ---
Assigned To: Red Hat Product Security
: Security
Depends On: 245994 245995 245996 245997 245998 245999 250599 250600
  Show dependency treegraph
Reported: 2007-06-27 15:46 EDT by Josh Bressers
Modified: 2008-01-17 10:47 EST (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2008-01-17 10:47:38 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Josh Bressers 2007-06-27 15:46:52 EDT
Chris Montgomery has informed us of a bug found in libvorbis.
The patch is in revision 13160 from http://svn.xiph.org/trunk/vorbis
(svn diff -r 13159:13160 http://svn.xiph.org/trunk/vorbis)

I'm calling this bug an "array boundary condition flaw".  It's the best
definition I could find that matched up with something MITRE uses.  The
issue in question is related to the usage of a function pointer table.
Here is an example:


What happens is the value of 'ci->map_type[i]' can be an attacker
controlled 16 bit unsigned integer.  The amount of play with the that
function pointer is a bit suspect I admit, but I suspect it's still
exploitable (some peer review from someone better at this sort of thing
would be helpful).

The code in question is called when libvorbis starts to clean things up
after receiving bad data.
Comment 6 Josh Bressers 2007-07-26 16:28:11 EDT
Lifting embargo:
Comment 9 Red Hat Product Security 2008-01-17 10:47:38 EST
This issue was addressed in:

Red Hat Enterprise Linux:


Note You need to log in before you can comment on or make changes to this bug.