CVE-2014-9638 — Divide By Zero in Opus-tools

CWE-369 — Divide By Zero9 documents7 sources
Severity
5.0MEDIUMNVD
EPSS
1.3%
top 20.41%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
Xiph Vorbis-toolsDebian Opus-toolsDebian Vorbis-tools+4 more
Timeline
PublishedJan 23
Latest updateMay 14

Description

oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (divide-by-zero error and crash) via a WAV file with the number of channels set to zero.

CVSS vector

AV:N/AC:L/C:N/I:N/A:PExploitability: 10.0 | Impact: 2.9

Affected Packages7 packages

▶debiandebian/vorbis-tools< opus-tools 0.1.10-1 (bookworm)
▶Debianxiph/vorbis-tools< 1.4.0-7+3
▶debiandebian/opus-tools< opus-tools 0.1.10-1 (bookworm)
▶NVDopensuse/opensuse13.1, 13.2+1

Also affects: Fedora 20, 21

🔴Vulnerability Details

2
GHSA
GHSA-m9g9-3p8f-5mgj: oggenc in vorbis-tools 1↗2022-05-14
▶
OSV
CVE-2014-9638: oggenc in vorbis-tools 1↗2015-01-23
▶

📋Vendor Advisories

3
Microsoft
CVE-2014-9638: NIST NVD Details: https://nvd↗2021-12-14
▶
Red Hat
vorbis-tools: division by zero on crafted WAV file↗2015-01-18
▶
Debian
CVE-2014-9638: opus-tools - oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of servic...↗2014
▶

💬Community

3
Bugzilla
CVE-2017-11331 vorbis-tools: Invalid memory allocation in wav_open function in oggenc/audio.c↗2017-08-11
▶
Bugzilla
CVE-2014-9638 CVE-2014-9639 CVE-2014-9640 vorbis-tools: various flaws [fedora-all]↗2015-01-23
▶
Bugzilla
CVE-2014-9638 vorbis-tools: division by zero on crafted WAV file↗2015-01-21
▶