CVE-2008-1420
Fixed in a distro release EPSS 6%
Integer overflow in residue partition value (aka partvals) evaluation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to execute arbitrary code via a crafted OGG file, which triggers a heap overflow.
Products: xiph.org libvorbis
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | libvorbis | 1.2.0.dfsg-3.1 |
| Debian 13 | libvorbis | 1.2.0.dfsg-3.1 |
| Debian 14 | libvorbis | 1.2.0.dfsg-3.1 |
| Debian 4.0 | libvorbis | 1.1.2.dfsg-1.4 |
| Red Hat Enterprise Linux 2.1 | libvorbis | 0:1.0rc2-9.el2 |
| Red Hat Enterprise Linux 2.1 | libvorbis-devel | 0:1.0rc2-9.el2 |
| Red Hat Enterprise Linux 3 | libvorbis | 1:1.0-10.el3 |
| Red Hat Enterprise Linux 3 | libvorbis-debuginfo | 1:1.0-10.el3 |
| Red Hat Enterprise Linux 3 | libvorbis-devel | 1:1.0-10.el3 |
| Red Hat Enterprise Linux 4 | libvorbis | 1:1.1.0-3.el4_6.1 |
| Red Hat Enterprise Linux 4 | libvorbis-debuginfo | 1:1.1.0-3.el4_6.1 |
| Red Hat Enterprise Linux 4 | libvorbis-devel | 1:1.1.0-3.el4_6.1 |
| Red Hat Enterprise Linux 5 | libvorbis | 1:1.1.2-3.el5_1.2 |
| Red Hat Enterprise Linux 5 | libvorbis-debuginfo | 1:1.1.2-3.el5_1.2 |
| Red Hat Enterprise Linux 5 | libvorbis-devel | 1:1.1.2-3.el5_1.2 |
| openSUSE Tumbleweed | libvorbis | 1.3.5-2.1 |