Updated libvorbis packages that fix various security issues are now available for Red Hat Enterprise Linux 2.1.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The libvorbis packages contain runtime libraries for use in programs that support Ogg Vorbis. Ogg Vorbis is a fully open, non-proprietary, patent-and royalty-free, general-purpose compressed audio format.

Will Drewry of the Google Security Team reported several flaws in the way libvorbis processed audio data. An attacker could create a carefully crafted OGG audio file in such a way that it could cause an application linked with libvorbis to crash, or execute arbitrary code when it was opened. (CVE-2008-1419, CVE-2008-1420, CVE-2008-1423, CVE-2008-2009)

Moreover, additional OGG file sanity-checks have been added to prevent possible exploitation of similar issues in the future.

Users of libvorbis are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

It was discovered that libvorbis did not correctly handle ogg files with underpopulated Huffman trees. If a user were tricked into opening a specially crafted ogg file with an application that uses libvorbis, an attacker could cause a denial of service. (CVE-2008-2009)

It was discovered that libvorbis did not correctly handle certain malformed ogg files. If a user were tricked into opening a specially crafted ogg file with an application that uses libvorbis, an attacker could cause a denial of service or possibly execute arbitrary code with the user's privileges. (CVE-2009-3379).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

RedHat プロジェクトの報告：

Google セキュリティチームの Will Drewry 氏は、OGG Vorbis と Tremor ライブラリに複数の問題があることを報告しました。これにより、これらのライブラリを使用するアプリケーションがクラッシュ（NULL ポインターデリファレンスまたはゼロ除算）したり、無限ループに陥ったり、整数オーバーフローによって発生するヒープオーバーフローを引き起こす可能性があります。

The RedHat Project reports :

Will Drewry of the Google Security Team reported multiple issues in OGG Vorbis and Tremor libraries, that could cause application using those libraries to crash (NULL pointer dereference or divide by zero), enter an infinite loop or cause heap overflow caused by integer overflow.

RedHat 项目报告：

Google 安全团队的 Will Drewry 报告在 OGG Vorbis 和 Tremor 库中发现多个问题，这些问题可导致使用这些库的应用程序崩溃（空指针取消引用或除以零）、进入无限循环或造成由整数溢出导致的堆溢出。

RedHat Project 報告：

Google 安全性團隊的 Will Drewry 報告，OGG Vorbis 和 Tremor 程式庫中存在多個問題，會造成使用這些程式庫的應用程式損毀 (NULL 指標解除參照或除以零)、進入無限迴圈或造成因整數溢位而發生的堆積溢位。

ID	名稱	產品	系列	已發布	已更新	嚴重性
32356	RHEL 2.1 : libvorbis (RHSA-2008:0271)	Nessus	Red Hat Local Security Checks	2008/5/16	2021/1/14	high
42891	Ubuntu 8.04 LTS / 8.10 / 9.04 / 9.10 : libvorbis vulnerabilities (USN-861-1)	Nessus	Ubuntu Local Security Checks	2009/11/25	2021/1/19	critical
85639	FreeBSD：libtremor -- 複数の脆弱性（3dac84c9-bce1-4199-9784-d68af1eb7b2e）	Nessus	FreeBSD Local Security Checks	2015/8/26	2021/1/6	high
85639	FreeBSD : libtremor -- multiple vulnerabilities (3dac84c9-bce1-4199-9784-d68af1eb7b2e)	Nessus	FreeBSD Local Security Checks	2015/8/26	2021/1/6	high
85639	FreeBSD：libtremor -- 多种漏洞 (3dac84c9-bce1-4199-9784-d68af1eb7b2e)	Nessus	FreeBSD Local Security Checks	2015/8/26	2021/1/6	high
85639	FreeBSD：libtremor -- 多個弱點 (3dac84c9-bce1-4199-9784-d68af1eb7b2e)	Nessus	FreeBSD Local Security Checks	2015/8/26	2021/1/6	high

偵測

搜尋 Plugin

high

critical

high

high

high

high