oggenc/oggenc.c in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted raw file.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - vorbis-tools: segfault when trying to encode trivial raw input (CVE-2014-9640)

  - vorbis-tools: Invalid memory allocation in wav_open function in oggenc/audio.c (CVE-2017-11331)

  - oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (divide-by-zero error     and crash) via a WAV file with the number of channels set to zero. (CVE-2014-9638)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - vorbis-tools: segfault when trying to encode trivial raw input (CVE-2014-9640)

  - vorbis-tools: Invalid memory allocation in wav_open function in oggenc/audio.c (CVE-2017-11331)

  - oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (divide-by-zero error     and crash) via a WAV file with the number of channels set to zero. (CVE-2014-9638)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

vorbis-tools is vulnerable to multiple issues that can result in denial of service.

CVE-2014-9638

Divide by zero error in oggenc with a WAV file whose number of channels is set to zero.

CVE-2014-9639

Integer overflow in oggenc via a crafted number of channels in a WAV file, which triggers an out-of-bounds memory access.

CVE-2014-9640

Out-of bounds read in oggenc via a crafted raw file.

CVE-2015-6749

Buffer overflow in the aiff_open function in oggenc/audio.c via a crafted AIFF file.

For Debian 7 'Wheezy', these problems have been fixed in version 1.4.0-1+deb7u1.

We recommend that you upgrade your vorbis-tools packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Various issues have been fixed in Debian LTS (squeeze) for package vorbis-tools.

CVE-2014-9638

A crafted WAV file with number of channels set to 0 will cause oggenc to crash due to a division by zero issue. This issue has been fixed upstream by providing a fix for CVE-2014-9639. Reported upstream by 'zuBux'.

CVE-2014-9639

An integer overflow issue was discovered in oggenc, related to the number of channels in the input WAV file. The issue triggers an out-of-bounds memory access which causes oggenc to crash here (audio.c). Reported upstream by 'zuBux'.

The upstream fix for this has been backported to vorbis-tools in Debian LTS (squeeze).

CVE-2014-9640

Fix for a crash on closing raw input (dd if=/dev/zero bs=1 count=1 | oggenc -r - -o out.ogg). Reported upstream by 'hanno'.

The upstream fix for this has been backported to vorbis-tools in Debian LTS (squeeze).

CVE-2015-6749

Buffer overflow in the aiff_open function in oggenc/audio.c in vorbis-tools 1.4.0 and earlier allowed remote attackers to cause a denial of service (crash) via a crafted AIFF file. Reported upstream by 'pengsu'.

The upstream fix for this has been backported to vorbis-tools in Debian LTS (squeeze).

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes the following security issue :

  - A crafted raw file used as input could cause a     segmentation fault (CVE-2014-9640, bsc#914938)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

vorbis-tools was updated to fix one security issue.

This security issue was fixed :

  - Segfault when trying to encode trivial raw input     (CVE-2014-9640).

Updated vorbis-tools package fixes security vulnerability :

oggenc/oggenc.c in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted raw file (CVE-2014-9640).

- do not use stack variable out of its scope of validity     (CVE-2014-9640)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198565	RHEL 7 : vorbis-tools (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
198527	RHEL 6 : vorbis-tools (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
101209	Debian DLA-1010-1 : vorbis-tools security update	Nessus	Debian Local Security Checks	medium
86196	Debian DLA-317-1 : vorbis-tools security update	Nessus	Debian Local Security Checks	medium
83689	SUSE SLED12 / SLES12 Security Update : vorbis-tools (SUSE-SU-2015:0367-1)	Nessus	SuSE Local Security Checks	medium
81240	openSUSE Security Update : vorbis-tools (openSUSE-2015-114)	Nessus	SuSE Local Security Checks	medium
81237	Mandriva Linux Security Advisory : vorbis-tools (MDVSA-2015:037)	Nessus	Mandriva Local Security Checks	medium
81171	Fedora 20 : vorbis-tools-1.4.0-13.fc20 (2015-1191)	Nessus	Fedora Local Security Checks	medium
81094	Fedora 21 : vorbis-tools-1.4.0-18.fc21 (2015-1253)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2014-9640

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium