Buffer overflow in the aiff_open function in oggenc/audio.c in vorbis-tools 1.4.0 and earlier allows remote attackers to cause a denial of service (crash) via a crafted AIFF file.

vorbis-tools is vulnerable to multiple issues that can result in denial of service.

CVE-2014-9638

Divide by zero error in oggenc with a WAV file whose number of channels is set to zero.

CVE-2014-9639

Integer overflow in oggenc via a crafted number of channels in a WAV file, which triggers an out-of-bounds memory access.

CVE-2014-9640

Out-of bounds read in oggenc via a crafted raw file.

CVE-2015-6749

Buffer overflow in the aiff_open function in oggenc/audio.c via a crafted AIFF file.

For Debian 7 'Wheezy', these problems have been fixed in version 1.4.0-1+deb7u1.

We recommend that you upgrade your vorbis-tools packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

vorbis-tools was updated to fix several security issues.

  - A buffer overflow in aiff_open() that could be triggered     by opening prepared malicious files (CVE-2015-6749,     bsc#943795).

  - A division by zero and integer overflow by crafted WAV     files was fixed (CVE-2014-9638, CVE-2014-9639,     bnc#914439, bnc#914441).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

vorbis-tools was updated to fix a buffer overflow in aiff_open() that could be triggered by opening prepared malicious files.
(CVE-2015-6749, bsc#943795).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

vorbis-tools was updated to fix a buffer overflow in aiff_open(), that could be used to crash or potentially execute code when opening aiff format files. (CVE-2015-6749, bsc#943795).

Various issues have been fixed in Debian LTS (squeeze) for package vorbis-tools.

CVE-2014-9638

A crafted WAV file with number of channels set to 0 will cause oggenc to crash due to a division by zero issue. This issue has been fixed upstream by providing a fix for CVE-2014-9639. Reported upstream by 'zuBux'.

CVE-2014-9639

An integer overflow issue was discovered in oggenc, related to the number of channels in the input WAV file. The issue triggers an out-of-bounds memory access which causes oggenc to crash here (audio.c). Reported upstream by 'zuBux'.

The upstream fix for this has been backported to vorbis-tools in Debian LTS (squeeze).

CVE-2014-9640

Fix for a crash on closing raw input (dd if=/dev/zero bs=1 count=1 | oggenc -r - -o out.ogg). Reported upstream by 'hanno'.

The upstream fix for this has been backported to vorbis-tools in Debian LTS (squeeze).

CVE-2015-6749

Buffer overflow in the aiff_open function in oggenc/audio.c in vorbis-tools 1.4.0 and earlier allowed remote attackers to cause a denial of service (crash) via a crafted AIFF file. Reported upstream by 'pengsu'.

The upstream fix for this has been backported to vorbis-tools in Debian LTS (squeeze).

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- oggenc: fix large alloca on bad AIFF input     (CVE-2015-6749)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Paris Zoumpouloglou reports :

I discovered an integer overflow issue in oggenc, related to the number of channels in the input WAV file. The issue triggers an out-of-bounds memory access which causes oggenc to crash.

Paris Zoumpouloglou reports :

A crafted WAV file with number of channels set to 0 will cause oggenc to crash due to a division by zero issue.

pengsu reports :

I discovered an buffer overflow issue in oggenc/audio.c when it tries to open invalid aiff file.

ID	Name	Product	Family	Severity
101209	Debian DLA-1010-1 : vorbis-tools security update	Nessus	Debian Local Security Checks	medium
86464	SUSE SLED11 Security Update : vorbis-tools (SUSE-SU-2015:1775-1)	Nessus	SuSE Local Security Checks	medium
86440	SUSE SLED12 / SLES12 Security Update : vorbis-tools (SUSE-SU-2015:1765-1)	Nessus	SuSE Local Security Checks	medium
86283	openSUSE Security Update : vorbis-tools (openSUSE-2015-633)	Nessus	SuSE Local Security Checks	medium
86196	Debian DLA-317-1 : vorbis-tools security update	Nessus	Debian Local Security Checks	medium
85964	Fedora 22 : vorbis-tools-1.4.0-20.fc22 (2015-14663)	Nessus	Fedora Local Security Checks	medium
85893	FreeBSD : vorbis-tools, opus-tools -- multiple vulnerabilities (a35f415d-572a-11e5-b0a4-f8b156b6dcc8)	Nessus	FreeBSD Local Security Checks	medium
85826	Fedora 23 : vorbis-tools-1.4.0-22.fc23 (2015-14664)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2015-6749

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium