CVE-2007-4029

Multiple libvorbis flaws (CVE-2007-4066, CVE-2007-4029)

Published Jul 26, 2007 CVSS 2.0 · 6.8 Medium EPSS 1.7% KEV · Not listed
Description
libvorbis 1.1.2, and possibly other versions before 1.2.0, allows context-dependent attackers to cause a denial of service via (1) an invalid mapping type, which triggers an out-of-bounds read in the vorbis_info_clear function in info.c, and (2) invalid blocksize values that trigger a segmentation fault in the read function in block.c.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DSA Debian DSA DSA-1471-1 New libvorbis packages fix several vulnerabilities
EUVD EUVD EUVD-2007-4013 libvorbis 1.1.2, and possibly other versions before 1.2.0, allows context-dependent attackers to cause a denial of service via (1) an invalid mapping type, which triggers an out-of-bounds read in the vorbis_info_clear function in info.c, and (2) invalid blocksize values that trigger a segmentation fault in the read function in block.c.
Ubuntu USN Ubuntu USN USN-498-1 libvorbis vulnerabilities
References
Link Providers
http://secunia.com/advisories/24923 cve-icon cve-icon
http://secunia.com/advisories/26087 cve-icon cve-icon
http://secunia.com/advisories/26232 cve-icon cve-icon
http://secunia.com/advisories/26299 cve-icon cve-icon
http://secunia.com/advisories/26429 cve-icon cve-icon
http://secunia.com/advisories/26535 cve-icon cve-icon
http://secunia.com/advisories/26865 cve-icon cve-icon
http://secunia.com/advisories/27099 cve-icon cve-icon
http://secunia.com/advisories/27439 cve-icon cve-icon
http://secunia.com/advisories/28614 cve-icon cve-icon
http://security.gentoo.org/glsa/glsa-200710-03.xml cve-icon cve-icon
http://securitytracker.com/id?1018712 cve-icon cve-icon
http://www.debian.org/security/2008/dsa-1471 cve-icon cve-icon
http://www.isecpartners.com/advisories/2007-003-libvorbis.txt cve-icon cve-icon
http://www.mandriva.com/security/advisories?name=MDKSA-2007:167-1 cve-icon cve-icon
http://www.novell.com/linux/security/advisories/2007_23_sr.html cve-icon cve-icon
http://www.redhat.com/support/errata/RHSA-2007-0845.html cve-icon cve-icon
http://www.redhat.com/support/errata/RHSA-2007-0912.html cve-icon cve-icon
http://www.securityfocus.com/archive/1/474729/100/0/threaded cve-icon cve-icon
http://www.securityfocus.com/bid/25082 cve-icon cve-icon
http://www.tellini.org/blog/archives/32-Music-Box-1.6.html cve-icon cve-icon
http://www.ubuntu.com/usn/usn-498-1 cve-icon cve-icon
http://www.vupen.com/english/advisories/2007/2698 cve-icon cve-icon
http://www.vupen.com/english/advisories/2007/2760 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=249780 cve-icon cve-icon
https://exchange.xforce.ibmcloud.com/vulnerabilities/35623 cve-icon cve-icon
https://exchange.xforce.ibmcloud.com/vulnerabilities/35624 cve-icon cve-icon
https://issues.rpath.com/browse/RPL-1590 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2007-4029 cve-icon
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10570 cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2007-4029 cve-icon
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 7, 2024, 2:37 PM
Reserved
Jul 26, 2007, 12:00 AM
Status
Modified
Published
Jul 26, 2007, 10:30 PM
Modified
Jun 16, 2026, 10:43 PM
Severity
Important
Public date
Jul 26, 2007, 12:00 AM