Patchwire CVEs, their patch status, and feeds to follow them

CVE-2017-14160

Fixed in a distro release EPSS 5%

The bark_noise_hybridmp function in psy.c in Xiph.Org libvorbis 1.3.5 allows remote attackers to cause a denial of service (out-of-bounds access and application crash) or possibly have unspecified other impact via a crafted mp4 file.

Published 2017-09-21 · CVE record · OSV

Products: xiph.org libvorbis, debian_linux

Distro releases

ReleasePackageFixed in
Alpine 3.10libvorbis1.3.5-r3
Alpine 3.11libvorbis1.3.5-r3
Alpine 3.12libvorbis1.3.5-r3
Alpine 3.13libvorbis1.3.5-r3
Alpine 3.14libvorbis1.3.5-r3
Alpine 3.15libvorbis1.3.5-r3
Alpine 3.16libvorbis1.3.5-r3
Alpine 3.17libvorbis1.3.5-r3
Alpine 3.18libvorbis1.3.5-r3
Alpine 3.19libvorbis1.3.5-r3
Alpine 3.20libvorbis1.3.5-r3
Alpine 3.21libvorbis1.3.5-r3
Alpine 3.22libvorbis1.3.5-r3
Alpine 3.23libvorbis1.3.5-r3
Alpine 3.24libvorbis1.3.5-r3
Alpine 3.3libvorbis1.3.5-r2
Alpine 3.4libvorbis1.3.5-r2
Alpine 3.5libvorbis1.3.5-r2
Alpine 3.6libvorbis1.3.5-r2
Alpine 3.7libvorbis1.3.5-r3
Alpine 3.8libvorbis1.3.5-r3
Alpine 3.9libvorbis1.3.5-r3
Debian 12libvorbis1.3.6-2
Debian 13libvorbis1.3.6-2
Debian 14libvorbis1.3.6-2
Debian 8libvorbis1.3.4-2+deb8u2
Debian 9libvorbis1.3.5-4+deb9u3
SUSE Linux Enterprise Desktop 12 SP3libvorbis1.3.3-10.11.1
SUSE Linux Enterprise Server 11 SP4libvorbis1.2.0-79.20.11.1
SUSE Linux Enterprise Server 12 SP3libvorbis1.3.3-10.11.1
SUSE Linux Enterprise Server for SAP Applications 11 SP4libvorbis1.2.0-79.20.11.1
SUSE Linux Enterprise Server for SAP Applications 12 SP3libvorbis1.3.3-10.11.1
SUSE Linux Enterprise Software Development Kit 11 SP4libvorbis1.2.0-79.20.11.1
SUSE Linux Enterprise Software Development Kit 12 SP3libvorbis1.3.3-10.11.1
Ubuntu 18.04 LTSlibvorbisno fix
Ubuntu Pro 16.04 LTSlibvorbis1.3.5-3ubuntu0.2+esm1
openSUSE Tumbleweedlibvorbis1.3.7-1.6