The fill_buffer_resample function in util.c in libmp3lame.a in LAME 3.99.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted audio file.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The fill_buffer_resample function in util.c in libmp3lame.a in LAME 3.99.5 allows remote attackers to     cause a denial of service (NULL pointer dereference and application crash) via a crafted audio file.
    (CVE-2015-9100)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4780-1 advisory.

    It was discovered that LAME incorrectly handled certain audio files. A remote attacker could possibly use     this issue to cause a denial of service. Eight vulnerabilities (CVE-2015-9099, CVE-2015-9100,     CVE-2015-9101, CVE-2017-15018, CVE-2017-11720, CVE-2017-8419, CVE-2017-9412, CVE-2017-15045) only affected     Ubuntu 14.04 ESM, two vulnerabilities (CVE-2017-9410 and CVE-2017-9411) only affected Ubuntu 16.04 ESM,     and one vulnerability (CVE-2017-15019) affected both Ubuntu 14.04 ESM and Ubuntu 16.04.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for lame fixes the following issues :

Lame was updated to version 3.100 :

  - Improved detection of MPEG audio data in RIFF WAVE     files. sf#3545112 Invalid sampling detection

  - New switch --gain <decibel>, range -20.0 to +12.0, a     more convenient way to apply Gain adjustment in     decibels, than the use of --scale <factor>.

  - Fix for sf#3558466 Bug in path handling

  - Fix for sf#3567844 problem with Tag genre

  - Fix for sf#3565659 no progress indication with pipe     input

  - Fix for sf#3544957 scale (empty) silent encode without     warning

  - Fix for sf#3580176 environment variable LAMEOPT doesn't     work anymore

  - Fix for sf#3608583 input file name displayed with wrong     character encoding (on windows console with CP_UTF8)

  - Fix dereference NULL and Buffer not NULL terminated     issues. (CVE-2017-15019 bsc#1082317 CVE-2017-13712     bsc#1082399 CVE-2015-9100 bsc#1082401)

  - Fix dereference of a NULL pointer possible in loop.

  - Make sure functions with SSE instructions maintain their     own properly aligned stack. Thanks to Fabian Greffrath

  - Multiple Stack and Heap Corruptions from Malicious File.
    (CVE-2017-9872 bsc#1082391 CVE-2017-9871 bsc#1082392     CVE-2017-9870 bsc#1082393 CVE-2017-9869 bsc#1082395     CVE-2017-9411 bsc#1082397 CVE-2015-9101 bsc#1082400)

  - CVE-2017-11720: Fix a division by zero vulnerability.
    (bsc#1082311)

  - CVE-2017-9410: Fix fill_buffer_resample function in     libmp3lame/util.c heap-based buffer over-read and ap     (bsc#1082333)

  - CVE-2017-9411: Fix fill_buffer_resample function in     libmp3lame/util.c invalid memory read and application     crash (bsc#1082397)

  - CVE-2017-9412: FIx unpack_read_samples function in     frontend/get_audio.c invalid memory read and application     crash (bsc#1082340)

  - Fix clip detect scale suggestion unaware of scale input     value

  - HIP decoder bug fixed: decoding mixed blocks of lower     sample frequency Layer3 data resulted in internal buffer     overflow.

  - Add lame_encode_buffer_interleaved_int()

ID	Name	Product	Family	Severity
219487	Linux Distros Unpatched Vulnerability : CVE-2015-9100	Nessus	Misc.	medium
183698	Ubuntu 16.04 ESM : LAME vulnerabilities (USN-4780-1)	Nessus	Ubuntu Local Security Checks	critical
107048	openSUSE Security Update : lame (openSUSE-2018-214)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2015-9100

medium

Tenable Plugins

medium

critical

critical