Bug 249780 - (CVE-2007-4065) CVE-2007-4065 Multiple libvorbis flaws (CVE-2007-4066, CVE-2007-4029)
CVE-2007-4065 Multiple libvorbis flaws (CVE-2007-4066, CVE-2007-4029)
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
high Severity high
: ---
: ---
Assigned To: Red Hat Product Security
reported=20070726,source=redhat,impac...
: Security
Depends On: 250612 250613 250614 250615 250616 250617 250618 250619 251668
Blocks:
  Show dependency treegraph
 
Reported: 2007-07-26 19:23 EDT by Josh Bressers
Modified: 2008-01-17 10:47 EST (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-01-17 10:47:49 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Josh Bressers 2007-07-26 19:23:55 EDT
Multiple flaws have been found in libvorbis.  These are fixed via libvorbis
version 1.2.0.

It should be noted that libvorbis 1.2.0 also fixes the issue described in bug
245991.

The id number of each flaw is the subversion commit id.  The descriptions were
provided by Chris Montgomery.  The libvorbis subversion repository is located here:
http://svn.xiph.org/trunk/vorbis

13217: possible seek infinite loop in libvorbisfile
13215: multiplexed/non Vorbis stream support [heap read, potential heap write]
13211: better return value checking of seeks [heap read, potential heap write]
13179: check legal maximum blocksize [static array read]
13169,13170,13172: correctly handle codebooks with zero entires [heap read/write]
13168: low bitrate static mode declaration error [static read, heap read,
potential heap write]
13151,13153,13154,13155,13167: residue decode vector overflow [heap read/write]
13162: static initializer declarations, check-before-free error fixes [heap
read/write]
13149: check legal minimum blocksize [static array read]
Comment 3 Josh Bressers 2007-08-20 16:09:54 EDT
Here is the breakdown of CVE id to libvorbis commit id mapping:

CVE-2007-4065: 13217 (infinite loop)

CVE-2007-4029 covers 2 issues with unknown commit IDs.

  According to Monty these two issues are the commit ids:
  13151, 13154, 13155, 13167
  and
  13149, 13153, 13179

CVE-2007-4066: multiple flaws

      13215: multiplexed/non Vorbis stream support
             [heap read, potential heap write]

      13211: better return value checking of seeks
             [heap read, potential heap write]

      13169,13170,13172: correctly handle codebooks with zero entires
                         [heap read/write]

      13168: low bitrate static mode declaration error
             [static read, heap read, potential heap write]

      13162: static initializer declarations, check-before-free error fixes
             [heap read/write]
Comment 6 Red Hat Product Security 2008-01-17 10:47:49 EST
This issue was addressed in:

Red Hat Enterprise Linux:
  http://rhn.redhat.com/errata/RHSA-2007-0845.html
  http://rhn.redhat.com/errata/RHSA-2007-0912.html

Fedora:
  https://admin.fedoraproject.org/updates/F7/FEDORA-2007-1765


Note You need to log in before you can comment on or make changes to this bug.