CVE-2018-10392

Опубликовано: 26 апр. 2018

Источник: nvd

CVSS3: 8.8

CVSS2: 6.8

EPSS Низкий

Описание

mapping0_forward in mapping0.c in Xiph.Org libvorbis 1.3.6 does not validate the number of channels, which allows remote attackers to cause a denial of service (heap-based buffer overflow or over-read) or possibly have unspecified other impact via a crafted file.

Ссылки

https://access.redhat.com/errata/RHSA-2019:3703
Third Party Advisory
https://gitlab.xiph.org/xiph/vorbis/issues/2335
Exploit
Issue Tracking
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2019/11/msg00031.html
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/11/msg00023.html
Mailing List
Third Party Advisory
https://security.gentoo.org/glsa/202003-36
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3703
Third Party Advisory
https://gitlab.xiph.org/xiph/vorbis/issues/2335
Exploit
Issue Tracking
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2019/11/msg00031.html
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/11/msg00023.html
Mailing List
Third Party Advisory
https://security.gentoo.org/glsa/202003-36
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:xiph.org:libvorbis:1.3.6:*:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*

EPSS

Процентиль: 79%

0.01361

Низкий

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-125

Связанные уязвимости

CVE-2018-10392

CVSS3: 8.8

ubuntu

около 7 лет назад

CVE-2018-10392

CVSS3: 3.3

redhat

около 7 лет назад

CVE-2018-10392

CVSS3: 8.8

debian

около 7 лет назад

mapping0_forward in mapping0.c in Xiph.Org libvorbis 1.3.6 does not va ...

openSUSE-SU-2018:1953-1

suse-cvrf

почти 7 лет назад

Security update for libvorbis

openSUSE-SU-2018:1622-1

suse-cvrf

около 7 лет назад

Security update for libvorbis

EPSS

Процентиль: 79%

0.01361

Низкий

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-125