The wav_open function in oggenc/audio.c in Xiph.Org vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (memory allocation error) via a crafted wav file.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - vorbis-tools: segfault when trying to encode trivial raw input (CVE-2014-9640)

  - vorbis-tools: Invalid memory allocation in wav_open function in oggenc/audio.c (CVE-2017-11331)

  - oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (divide-by-zero error     and crash) via a WAV file with the number of channels set to zero. (CVE-2014-9638)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - vorbis-tools: segfault when trying to encode trivial raw input (CVE-2014-9640)

  - vorbis-tools: Invalid memory allocation in wav_open function in oggenc/audio.c (CVE-2017-11331)

  - oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (divide-by-zero error     and crash) via a WAV file with the number of channels set to zero. (CVE-2014-9638)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - vorbis-tools: division by zero on crafted WAV file (CVE-2014-9638)

  - vorbis-tools: Invalid memory allocation in wav_open function in oggenc/audio.c (CVE-2017-11331)

  - Buffer overflow in the aiff_open function in oggenc/audio.c in vorbis-tools 1.4.0 and earlier allows     remote attackers to cause a denial of service (crash) via a crafted AIFF file. (CVE-2015-6749)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

ID	Name	Product	Family	Severity
198565	RHEL 7 : vorbis-tools (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
198527	RHEL 6 : vorbis-tools (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
198517	RHEL 5 : vorbis-tools (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
195842	RHEL 7 : vorbis-tools (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
195826	RHEL 6 : vorbis-tools (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
195733	RHEL 5 : vorbis-tools (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2017-11331

medium

Tenable Plugins

medium

medium

medium

high

high

medium