CVE-2008-2009

Publication date 16 May 2008

Last updated 24 July 2024

Xiph.org libvorbis before 1.0 does not properly check for underpopulated Huffman trees, which allows remote attackers to cause a denial of service (crash) via a crafted OGG file that triggers memory corruption during execution of the _make_decode_tree function.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
libvorbis	9.10 karmic	Not affected
	9.04 jaunty	Fixed 1.2.0.dfsg-3.1ubuntu0.9.04.2
	8.10 intrepid	Fixed 1.2.0.dfsg-3.1ubuntu0.8.10.2
	8.04 LTS hardy	Fixed 1.2.0.dfsg-2ubuntu0.3
	6.06 LTS dapper	Ignored end of life

Notes

mdeslaur

description is misleading, part of the patch applies to recent versions.

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
libvorbis	Upstream: https://trac.xiph.org/changeset/2959 Upstream: https://trac.xiph.org/changeset/2960 Upstream: https://trac.xiph.org/changeset/14811

References

Related Ubuntu Security Notices (USN)