Bug 788858 (CVE-2011-3960) - CVE-2011-3960 libvorbis: Stack-buffer overflow in render_line
Summary: CVE-2011-3960 libvorbis: Stack-buffer overflow in render_line
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2011-3960
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-02-09 06:32 UTC by Huzaifa S. Sidhpurwala
Modified: 2021-02-24 13:12 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2012-02-09 07:33:54 UTC
Embargoed:


Attachments (Terms of Use)

Description Huzaifa S. Sidhpurwala 2012-02-09 06:32:15 UTC
Common Vulnerabilities and Exposures assigned an identifier CVE-2011-3960 to
the following vulnerability:

Name: CVE-2011-3960
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3960
Assigned: 20111001
Reference: CONFIRM:http://code.google.com/p/chromium/issues/detail?id=108416
Reference: CONFIRM:http://googlechromereleases.blogspot.com/2012/02/stable-channel-update.html

Google Chrome before 17.0.963.46 does not properly decode audio data,
which allows remote attackers to cause a denial of service
(out-of-bounds read) via unspecified vectors.

Comment 1 Huzaifa S. Sidhpurwala 2012-02-09 06:37:26 UTC
Patch:
https://trac.xiph.org/changeset/18183
https://trac.xiph.org/changeset/18184

Comment 2 Huzaifa S. Sidhpurwala 2012-02-09 07:32:32 UTC
(In reply to comment #1)
> Patch:
> https://trac.xiph.org/changeset/18183
> https://trac.xiph.org/changeset/18184

The above commits are not actually specific to the chrome security flaw fix. The guarding which has been added to prevent the overflow is already present in libvorbis.

Comment 3 Huzaifa S. Sidhpurwala 2012-02-09 07:33:13 UTC
Statement:

Not vulnerable. This issue did not affect the versions of libvorbis as shipped
with Red Hat Enterprise Linux 4, 5, and 6.

Comment 4 Huzaifa S. Sidhpurwala 2012-02-09 07:33:54 UTC
This issue does not affect the version of libvorbis as shipped with Fedora 15 and Fedora 16

Comment 5 Huzaifa S. Sidhpurwala 2012-02-09 09:45:05 UTC
(In reply to comment #2)
> (In reply to comment #1)
> > Patch:
> > https://trac.xiph.org/changeset/18183
> > https://trac.xiph.org/changeset/18184
> 
> The above commits are not actually specific to the chrome security flaw fix.
> The guarding which has been added to prevent the overflow is already present in
> libvorbis.

Just to clarify the above comment, the flaw does not affect libvorbis, because the relevant vulnerable code segment is not present in libvorbis.


Note You need to log in before you can comment on or make changes to this bug.