CVE-2018-10392
Fixed in a distro release EPSS 3%
mapping0_forward in mapping0.c in Xiph.Org libvorbis 1.3.6 does not validate the number of channels, which allows remote attackers to cause a denial of service (heap-based buffer overflow or over-read) or possibly have unspecified other impact via a crafted file.
Products: xiph.org libvorbis, debian_linux, redhat enterprise_linux, redhat enterprise_linux_eus, redhat enterprise_linux_server_aus, redhat enterprise_linux_server_tus
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | libvorbis | 1:1.3.6-2.el8 |
| AlmaLinux 8 | libvorbis-devel | 1:1.3.6-2.el8 |
| AlmaLinux 8 | libvorbis-devel-docs | 1:1.3.6-2.el8 |
| Alpine 3.10 | libvorbis | 1.3.6-r1 |
| Alpine 3.11 | libvorbis | 1.3.6-r1 |
| Alpine 3.12 | libvorbis | 1.3.6-r1 |
| Alpine 3.13 | libvorbis | 1.3.6-r1 |
| Alpine 3.14 | libvorbis | 1.3.6-r1 |
| Alpine 3.15 | libvorbis | 1.3.6-r1 |
| Alpine 3.16 | libvorbis | 1.3.6-r1 |
| Alpine 3.17 | libvorbis | 1.3.6-r1 |
| Alpine 3.18 | libvorbis | 1.3.6-r1 |
| Alpine 3.19 | libvorbis | 1.3.6-r1 |
| Alpine 3.20 | libvorbis | 1.3.6-r1 |
| Alpine 3.21 | libvorbis | 1.3.6-r1 |
| Alpine 3.22 | libvorbis | 1.3.6-r1 |
| Alpine 3.23 | libvorbis | 1.3.6-r1 |
| Alpine 3.24 | libvorbis | 1.3.6-r1 |
| Alpine 3.5 | libvorbis | 1.3.6-r1 |
| Alpine 3.6 | libvorbis | 1.3.6-r1 |
| Alpine 3.7 | libvorbis | 1.3.6-r1 |
| Alpine 3.8 | libvorbis | 1.3.6-r1 |
| Alpine 3.9 | libvorbis | 1.3.6-r1 |
| Debian 12 | libvorbis | 1.3.6-2 |
| Debian 13 | libvorbis | 1.3.6-2 |
| Debian 14 | libvorbis | 1.3.6-2 |
| Debian 8 | libvorbis | 1.3.4-2+deb8u2 |
| Debian 9 | libvorbis | 1.3.5-4+deb9u3 |
| Red Hat Enterprise Linux 8 | libvorbis | 1:1.3.6-2.el8 |
| Red Hat Enterprise Linux 8 | libvorbis-debuginfo | 1:1.3.6-2.el8 |
| Red Hat Enterprise Linux 8 | libvorbis-debugsource | 1:1.3.6-2.el8 |
| Red Hat Enterprise Linux 8 | libvorbis-devel | 1:1.3.6-2.el8 |
| Red Hat Enterprise Linux 8 | libvorbis-devel-docs | 1:1.3.6-2.el8 |
| Rocky Linux 8 | libvorbis | 1:1.3.6-2.el8 |
| SUSE Linux Enterprise Desktop 12 SP3 | libvorbis | 1.3.3-10.14.1 |
| SUSE Linux Enterprise Module for Basesystem 15 | libvorbis | 1.3.6-4.3.1 |
| SUSE Linux Enterprise Server 11 SP4 | libvorbis | 1.2.0-79.20.14.1 |
| SUSE Linux Enterprise Server 12 SP3 | libvorbis | 1.3.3-10.14.1 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | libvorbis | 1.2.0-79.20.14.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | libvorbis | 1.3.3-10.14.1 |
| SUSE Linux Enterprise Software Development Kit 11 SP4 | libvorbis | 1.2.0-79.20.14.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP3 | libvorbis | 1.3.3-10.14.1 |
| Ubuntu 18.04 LTS | libvorbis | no fix |
| Ubuntu Pro 16.04 LTS | libvorbis | 1.3.5-3ubuntu0.2+esm1 |
| openSUSE Tumbleweed | libvorbis | 1.3.7-1.6 |