CVE-2018-10393
Fixed in a distro release EPSS 2%
bark_noise_hybridmp in psy.c in Xiph.Org libvorbis 1.3.6 has a stack-based buffer over-read.
Products: xiph.org libvorbis, debian_linux, redhat enterprise_linux, redhat enterprise_linux_eus, redhat enterprise_linux_server_aus, redhat enterprise_linux_server_tus
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | libvorbis | 1:1.3.6-2.el8 |
| AlmaLinux 8 | libvorbis-devel | 1:1.3.6-2.el8 |
| AlmaLinux 8 | libvorbis-devel-docs | 1:1.3.6-2.el8 |
| Alpine 3.10 | libvorbis | 1.3.6-r2 |
| Alpine 3.11 | libvorbis | 1.3.6-r2 |
| Alpine 3.12 | libvorbis | 1.3.6-r2 |
| Alpine 3.13 | libvorbis | 1.3.6-r2 |
| Alpine 3.14 | libvorbis | 1.3.6-r2 |
| Alpine 3.15 | libvorbis | 1.3.6-r2 |
| Alpine 3.16 | libvorbis | 1.3.6-r2 |
| Alpine 3.17 | libvorbis | 1.3.6-r2 |
| Alpine 3.18 | libvorbis | 1.3.6-r2 |
| Alpine 3.19 | libvorbis | 1.3.6-r2 |
| Alpine 3.20 | libvorbis | 1.3.6-r2 |
| Alpine 3.21 | libvorbis | 1.3.6-r2 |
| Alpine 3.22 | libvorbis | 1.3.6-r2 |
| Alpine 3.23 | libvorbis | 1.3.6-r2 |
| Alpine 3.24 | libvorbis | 1.3.6-r2 |
| Alpine 3.6 | libvorbis | 1.3.6-r2 |
| Alpine 3.7 | libvorbis | 1.3.6-r2 |
| Alpine 3.8 | libvorbis | 1.3.6-r2 |
| Alpine 3.9 | libvorbis | 1.3.6-r2 |
| Debian 12 | libvorbis | 1.3.6-2 |
| Debian 13 | libvorbis | 1.3.6-2 |
| Debian 14 | libvorbis | 1.3.6-2 |
| Debian 8 | libvorbis | 1.3.4-2+deb8u2 |
| Debian 9 | libvorbis | 1.3.5-4+deb9u3 |
| Red Hat Enterprise Linux 8 | libvorbis | 1:1.3.6-2.el8 |
| Red Hat Enterprise Linux 8 | libvorbis-debuginfo | 1:1.3.6-2.el8 |
| Red Hat Enterprise Linux 8 | libvorbis-debugsource | 1:1.3.6-2.el8 |
| Red Hat Enterprise Linux 8 | libvorbis-devel | 1:1.3.6-2.el8 |
| Red Hat Enterprise Linux 8 | libvorbis-devel-docs | 1:1.3.6-2.el8 |
| Rocky Linux 8 | libvorbis | 1:1.3.6-2.el8 |
| SUSE Linux Enterprise Desktop 12 SP3 | libvorbis | 1.3.3-10.11.1 |
| SUSE Linux Enterprise Server 11 SP4 | libvorbis | 1.2.0-79.20.11.1 |
| SUSE Linux Enterprise Server 12 SP3 | libvorbis | 1.3.3-10.11.1 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | libvorbis | 1.2.0-79.20.11.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | libvorbis | 1.3.3-10.11.1 |
| SUSE Linux Enterprise Software Development Kit 11 SP4 | libvorbis | 1.2.0-79.20.11.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP3 | libvorbis | 1.3.3-10.11.1 |
| Ubuntu 18.04 LTS | libvorbis | no fix |
| Ubuntu Pro 16.04 LTS | libvorbis | 1.3.5-3ubuntu0.2+esm1 |
| openSUSE Tumbleweed | libvorbis | 1.3.7-1.6 |