rpm package
suse/libid3tag&distro=SUSE Linux Enterprise Desktop 12 SP2
pkg:rpm/suse/libid3tag&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP2
Vulnerabilities (4)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2004-2779 | Hig | 7.5 | < 0.15.1b-184.3.1 | 0.15.1b-184.3.1 | Feb 20, 2018 | id3_utf16_deserialize() in utf16.c in libid3tag through 0.15.1b misparses ID3v2 tags encoded in UTF-16 with an odd number of bytes, triggering an endless loop allocating memory until an OOM condition is reached, leading to denial-of-service (DoS). | |
| CVE-2017-11551 | Med | 5.5 | < 0.15.1b-184.3.1 | 0.15.1b-184.3.1 | Jul 31, 2017 | The id3_field_parse function in field.c in libid3tag 0.15.1b allows remote attackers to cause a denial of service (OOM) via a crafted MP3 file. | |
| CVE-2017-11550 | Med | 5.5 | < 0.15.1b-184.3.1 | 0.15.1b-184.3.1 | Jul 31, 2017 | The id3_ucs4_length function in ucs4.c in libid3tag 0.15.1b allows remote attackers to cause a denial of service (NULL Pointer Dereference and application crash) via a crafted mp3 file. | |
| CVE-2008-2109 | — | < 0.15.1b-184.3.1 | 0.15.1b-184.3.1 | May 7, 2008 | field.c in the libid3tag 0.15.0b library allows context-dependent attackers to cause a denial of service (CPU consumption) via an ID3_FIELD_TYPE_STRINGLIST field that ends in '\0', which triggers an infinite loop. |
- affected < 0.15.1b-184.3.1fixed 0.15.1b-184.3.1
id3_utf16_deserialize() in utf16.c in libid3tag through 0.15.1b misparses ID3v2 tags encoded in UTF-16 with an odd number of bytes, triggering an endless loop allocating memory until an OOM condition is reached, leading to denial-of-service (DoS).
- affected < 0.15.1b-184.3.1fixed 0.15.1b-184.3.1
The id3_field_parse function in field.c in libid3tag 0.15.1b allows remote attackers to cause a denial of service (OOM) via a crafted MP3 file.
- affected < 0.15.1b-184.3.1fixed 0.15.1b-184.3.1
The id3_ucs4_length function in ucs4.c in libid3tag 0.15.1b allows remote attackers to cause a denial of service (NULL Pointer Dereference and application crash) via a crafted mp3 file.
- CVE-2008-2109May 7, 2008affected < 0.15.1b-184.3.1fixed 0.15.1b-184.3.1
field.c in the libid3tag 0.15.0b library allows context-dependent attackers to cause a denial of service (CPU consumption) via an ID3_FIELD_TYPE_STRINGLIST field that ends in '\0', which triggers an infinite loop.