Buffer Overflow vulnerability in Vorbis-tools v.1.4.2 allows a local attacker to execute arbitrary code and cause a denial of service during the conversion of wav files to ogg files.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2024:0131 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2023-43361:
    Buffer Overflow vulnerability in Vorbis-tools v.1.4.2 allows a local attacker to execute arbitrary code     and cause a denial of service during the conversion of wav files to ogg files.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:3095 advisory.

    * vorbis-tools: Buffer Overflow vulnerability (CVE-2023-43361)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2024-3095 advisory.

    [1:1.4.0-29]
    - fix out-of-bounds read in oggenc (CVE-2023-43361)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:3095 advisory.

    The vorbis-tools packages provide an encoder, a decoder, a playback tool, and a comment editor for Ogg     Vorbis. Ogg Vorbis is a fully open, non-proprietary, patent- and royalty-free, general-purpose compressed     audio format.

    Security Fix(es):

    * vorbis-tools: Buffer Overflow vulnerability (CVE-2023-43361)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.10 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2024:3095 advisory.

  - Buffer Overflow vulnerability in Vorbis-tools v.1.4.2 allows a local attacker to execute arbitrary code     and cause a denial of service during the conversion of wav files to ogg files. (CVE-2023-43361)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-faff3dd9d6 advisory.

    Security fix for CVE-2023-43361

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-5f8da7c1f1 advisory.

    Security fix for CVE-2023-43361

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the a1a1f81c-7c13-11ee-bcf1-f8b156b6dcc8 advisory.

  - Buffer Overflow vulnerability in Vorbis-tools v.1.4.2 allows a local attacker to execute arbitrary code     and cause a denial of service during the conversion of wav files to ogg files. (CVE-2023-43361)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-414 advisory.

    Buffer Overflow vulnerability in Vorbis-tools v.1.4.2 allows a local attacker to execute arbitrary code     and cause a denial of service during the conversion of wav files to ogg files. (CVE-2023-43361)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4251-1 advisory.

  - Buffer Overflow vulnerability in Vorbis-tools v.1.4.2 allows a local attacker to execute arbitrary code     and cause a denial of service during the conversion of wav files to ogg files. (CVE-2023-43361)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4218-1 advisory.

  - Buffer Overflow vulnerability in Vorbis-tools v.1.4.2 allows a local attacker to execute arbitrary code     and cause a denial of service during the conversion of wav files to ogg files. (CVE-2023-43361)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
235981	Alibaba Cloud Linux 3 : 0131: vorbis-tools (ALINUX3-SA-2024:0131)	Nessus	Alibaba Cloud Linux Local Security Checks	high
235527	RockyLinux 8 : vorbis-tools (RLSA-2024:3095)	Nessus	Rocky Linux Local Security Checks	high
198020	Oracle Linux 8 : vorbis-tools (ELSA-2024-3095)	Nessus	Oracle Linux Local Security Checks	high
197795	RHEL 8 : vorbis-tools (RHSA-2024:3095)	Nessus	Red Hat Local Security Checks	high
197687	CentOS 8 : vorbis-tools (CESA-2024:3095)	Nessus	CentOS Local Security Checks	high
189672	Fedora 39 : vorbis-tools (2024-faff3dd9d6)	Nessus	Fedora Local Security Checks	high
189671	Fedora 38 : vorbis-tools (2024-5f8da7c1f1)	Nessus	Fedora Local Security Checks	high
184440	FreeBSD : vorbistools -- heap buffer overflow in oggenc (a1a1f81c-7c13-11ee-bcf1-f8b156b6dcc8)	Nessus	FreeBSD Local Security Checks	high
184424	Amazon Linux 2023 : vorbis-tools (ALAS2023-2023-414)	Nessus	Amazon Linux Local Security Checks	high
184028	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : vorbis-tools (SUSE-SU-2023:4251-1)	Nessus	SuSE Local Security Checks	high
183953	SUSE SLES12 Security Update : vorbis-tools (SUSE-SU-2023:4218-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2023-43361

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high