CVE-2008-2009
Fixed in a distro release EPSS 4%
Xiph.org libvorbis before 1.0 does not properly check for underpopulated Huffman trees, which allows remote attackers to cause a denial of service (crash) via a crafted OGG file that triggers memory corruption during execution of the _make_decode_tree function.
Products: xiph.org libvorbis, canonical ubuntu_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | libvorbis | 1.2.0.dfsg-4 |
| Debian 12 | libvorbisidec | 1.0.2+svn18153-0.1 |
| Debian 13 | libvorbis | 1.2.0.dfsg-4 |
| Debian 13 | libvorbisidec | 1.0.2+svn18153-0.1 |
| Debian 14 | libvorbis | 1.2.0.dfsg-4 |
| Debian 14 | libvorbisidec | 1.0.2+svn18153-0.1 |
| Red Hat Enterprise Linux 2.1 | libvorbis | 0:1.0rc2-9.el2 |
| Red Hat Enterprise Linux 2.1 | libvorbis-devel | 0:1.0rc2-9.el2 |