CVE-2008-1686
Fixed in a distro release EPSS 6%
Array index vulnerability in Speex 1.1.12 and earlier, as used in libfishsound 0.9.0 and earlier, including Illiminable DirectShow Filters and Annodex Plugins for Firefox, xine-lib before 1.1.12, and many other products, allows remote attackers to execute arbitrary code via a header structure containing a negative offset, which is used to dereference a function pointer.
Products: xine-lib, xiph speex, xiph libfishsound
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | libfishsound | 0.7.0-2.2 |
| Debian 12 | speex | 1.2~beta2-1 |
| Debian 13 | libfishsound | 0.7.0-2.2 |
| Debian 13 | speex | 1.2~beta2-1 |
| Debian 14 | libfishsound | 0.7.0-2.2 |
| Debian 14 | speex | 1.2~beta2-1 |
| Debian 4.0 | libfishsound | 0.7.0-2etch1 |
| Debian 4.0 | speex | 1.1.12-3etch1 |
| Debian 4.0 | xine-lib | 1.1.2+dfsg-7 |
| Debian 5.0 | libfishsound | 0.7.0-2.1+lenny1 |
| Debian 5.0 | speex | 1.1.12-3+lenny1 |
| Debian 5.0 | xine-lib | 1.1.10.1-2+lenny2 |
| Red Hat Enterprise Linux 4 | speex | 0:1.0.4-4.el4_6.1 |
| Red Hat Enterprise Linux 4 | speex-debuginfo | 0:1.0.4-4.el4_6.1 |
| Red Hat Enterprise Linux 4 | speex-devel | 0:1.0.4-4.el4_6.1 |
| Red Hat Enterprise Linux 5 | speex | 0:1.0.5-4.el5_1.1 |
| Red Hat Enterprise Linux 5 | speex-debuginfo | 0:1.0.5-4.el5_1.1 |
| Red Hat Enterprise Linux 5 | speex-devel | 0:1.0.5-4.el5_1.1 |
| openSUSE Tumbleweed | gstreamer-plugins-good | 1.18.5-2.1 |
| openSUSE Tumbleweed | vorbis-tools | 1.4.2-1.6 |