CVE-2017-9412
published 2017-07-27CVE-2017-9412: The unpack_read_samples function in frontend/get_audio.c in LAME 3.99.5 allows remote attackers to cause a denial of service (invalid memory read and…
PriorityP423medium5.5CVSS 3.0
AVLACLPRNUIRSUCNINAH
EXPLOIT
EPSS
3.97%
89.2th percentile
The unpack_read_samples function in frontend/get_audio.c in LAME 3.99.5 allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted wav file.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | lame | < lame 3.99.5+repack1-7 (bookworm) | lame 3.99.5+repack1-7 (bookworm) |
| debian | lame | < lame 3.99.5+repack1-8 (bookworm) | lame 3.99.5+repack1-8 (bookworm) |
| lame_project | lame | — | — |
| lame_project | lame | — | — |
| lame_project | lame | — | — |
| lame_project | lame | — | — |
| lame_project | lame | — | — |
| lame_project | lame | — | — |
| lame_project | lame | >= 0 < 3.99.5+repack1-7 | 3.99.5+repack1-7 |
| lame_project | lame | >= 0 < 3.99.5+repack1-8 | 3.99.5+repack1-8 |
| lame_project | lame | >= 0 < 3.99.5+repack1-7 | 3.99.5+repack1-7 |
| lame_project | lame | >= 0 < 3.99.5+repack1-8 | 3.99.5+repack1-8 |
| lame_project | lame | >= 0 < 3.99.5+repack1-7 | 3.99.5+repack1-7 |
| lame_project | lame | >= 0 < 3.99.5+repack1-8 | 3.99.5+repack1-8 |
| lame_project | lame | >= 0 < 3.99.5+repack1-7 | 3.99.5+repack1-7 |
| lame_project | lame | >= 0 < 3.99.5+repack1-8 | 3.99.5+repack1-8 |
| lame_project | lame | >= 0 < 3.99.5+repack1-3ubuntu1+esm3 | 3.99.5+repack1-3ubuntu1+esm3 |
| lame_project | lame | >= 0 < 3.99.5+repack1-9ubuntu0.1~esm2 | 3.99.5+repack1-9ubuntu0.1~esm2 |
CVSS provenance
nvdv3.05.5MEDIUMCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
vendor_ubuntu5.5MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
lame vulnerabilities
osv·2022-08-29·CVSS 5.5
CVE-2015-9099 [MEDIUM] lame vulnerabilities
lame vulnerabilities
It was discovered that LAME incorrectly handled certain audio files. A
remote attacker could possibly use this issue to cause a denial of service. Eight
vulnerabilities (CVE-2015-9099, CVE-2015-9100, CVE-2015-9101, CVE-2017-15018,
CVE-2017-11720, CVE-2017-8419, CVE-2017-9412, CVE-2017-15045) only affected Ubuntu 14.04
ESM, two vulnerabilities (CVE-2017-9410 and CVE-2017-9411) only affected Ubuntu
16.04 ESM, and one vulnerability (CVE-2017-15019) affected both Ubuntu 14.04
ESM and Ubuntu 16.04.
GHSA
GHSA-89mf-955x-wx32: The unpack_read_samples function in frontend/get_audio
ghsa_unreviewed·2022-05-17
CVE-2017-9412 [MEDIUM] CWE-119 GHSA-89mf-955x-wx32: The unpack_read_samples function in frontend/get_audio
The unpack_read_samples function in frontend/get_audio.c in LAME 3.99.5 allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted wav file.
GHSA
GHSA-pm45-cff9-w7v7: LAME 3
ghsa_unreviewed·2022-05-13·CVSS 5.5
CVE-2017-15046 [MEDIUM] CWE-119 GHSA-pm45-cff9-w7v7: LAME 3
LAME 3.99.5, 3.99.4, 3.98.4, 3.98.2, 3.98 and 3.97 have a stack-based buffer overflow in unpack_read_samples in frontend/get_audio.c, a different vulnerability than CVE-2017-9412.
OSV
CVE-2017-15046: LAME 3
osv·2017-10-06·CVSS 5.5
CVE-2017-15046 [MEDIUM] CVE-2017-15046: LAME 3
LAME 3.99.5, 3.99.4, 3.98.4, 3.98.2, 3.98 and 3.97 have a stack-based buffer overflow in unpack_read_samples in frontend/get_audio.c, a different vulnerability than CVE-2017-9412.
OSV
CVE-2017-9412: The unpack_read_samples function in frontend/get_audio
osv·2017-07-27·CVSS 5.5
CVE-2017-9412 [MEDIUM] CVE-2017-9412: The unpack_read_samples function in frontend/get_audio
The unpack_read_samples function in frontend/get_audio.c in LAME 3.99.5 allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted wav file.
Ubuntu
LAME vulnerabilities
vendor_ubuntu·2022-08-29·CVSS 5.5
CVE-2017-13712 [MEDIUM] LAME vulnerabilities
Title: LAME vulnerabilities
Summary: Several security issues were fixed in LAME.
It was discovered that LAME incorrectly handled certain audio files. A
remote attacker could possibly use this issue to cause a denial of service. Eight
vulnerabilities (CVE-2015-9099, CVE-2015-9100, CVE-2015-9101, CVE-2017-15018,
CVE-2017-11720, CVE-2017-8419, CVE-2017-9412, CVE-2017-15045) only affected Ubuntu 14.04
ESM, two vulnerabilities (CVE-2017-9410 and CVE-2017-9411) only affected Ubuntu
16.04 ESM, and one vulnerability (CVE-2017-15019) affected both Ubuntu 14.04
ESM and Ubuntu 16.04.
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2017-9412: lame - The unpack_read_samples function in frontend/get_audio.c in LAME 3.99.5 allows r...
vendor_debian·2017·CVSS 5.5
CVE-2017-9412 [MEDIUM] CVE-2017-9412: lame - The unpack_read_samples function in frontend/get_audio.c in LAME 3.99.5 allows r...
The unpack_read_samples function in frontend/get_audio.c in LAME 3.99.5 allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted wav file.
Scope: local
bookworm: resolved (fixed in 3.99.5+repack1-7)
bullseye: resolved (fixed in 3.99.5+repack1-7)
forky: resolved (fixed in 3.99.5+repack1-7)
sid: resolved (fixed in 3.99.5+repack1-7)
trixie: resolved (fixed in 3.99.5+repack1-7)
Debian
CVE-2017-15046: lame - LAME 3.99.5, 3.99.4, 3.98.4, 3.98.2, 3.98 and 3.97 have a stack-based buffer ove...
vendor_debian·2017·CVSS 5.5
CVE-2017-15046 [MEDIUM] CVE-2017-15046: lame - LAME 3.99.5, 3.99.4, 3.98.4, 3.98.2, 3.98 and 3.97 have a stack-based buffer ove...
LAME 3.99.5, 3.99.4, 3.98.4, 3.98.2, 3.98 and 3.97 have a stack-based buffer overflow in unpack_read_samples in frontend/get_audio.c, a different vulnerability than CVE-2017-9412.
Scope: local
bookworm: resolved (fixed in 3.99.5+repack1-8)
bullseye: resolved (fixed in 3.99.5+repack1-8)
forky: resolved (fixed in 3.99.5+repack1-8)
sid: resolved (fixed in 3.99.5+repack1-8)
trixie: resolved (fixed in 3.99.5+repack1-8)
Red Hat
lame: Multiple vulnerabilities
vendor_redhat·2015-02-05·CVSS 5.5
CVE-2017-9412 [MEDIUM] lame: Multiple vulnerabilities
lame: Multiple vulnerabilities
The unpack_read_samples function in frontend/get_audio.c in LAME 3.99.5 allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted wav file.
Package: lame (Red Hat Enterprise Linux 9) - Affected
Red Hat
lame: Multiple vulnerabilities
vendor_redhat·2015-02-05·CVSS 5.5
CVE-2017-15046 [MEDIUM] lame: Multiple vulnerabilities
lame: Multiple vulnerabilities
LAME 3.99.5, 3.99.4, 3.98.4, 3.98.2, 3.98 and 3.97 have a stack-based buffer overflow in unpack_read_samples in frontend/get_audio.c, a different vulnerability than CVE-2017-9412.
Package: lame (Red Hat Enterprise Linux 9) - Affected
No detection rules found.
Bugzilla
CVE-2015-9099 CVE-2015-9100 CVE-2017-8419 CVE-2017-9410 CVE-2017-9411 CVE-2017-9412 CVE-2017-11720 CVE-2017-13712 CVE-2017-15018 CVE-2017-15019 CVE-2017-15045 CVE-2017-15046 lame: Multiple vulnerabili
bugzilla·2017-07-12·CVSS 5.5
CVE-2015-9099 [MEDIUM] CVE-2015-9099 CVE-2015-9100 CVE-2017-8419 CVE-2017-9410 CVE-2017-9411 CVE-2017-9412 CVE-2017-11720 CVE-2017-13712 CVE-2017-15018 CVE-2017-15019 CVE-2017-15045 CVE-2017-15046 lame: Multiple vulnerabili
CVE-2015-9099 CVE-2015-9100 CVE-2017-8419 CVE-2017-9410 CVE-2017-9411 CVE-2017-9412 CVE-2017-11720 CVE-2017-13712 CVE-2017-15018 CVE-2017-15019 CVE-2017-15045 CVE-2017-15046 lame: Multiple vulnerabilities
CVE-2015-9099
The lame_init_params function in lame.c in libmp3lame.a in LAME 3.99.5 allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted audio file with a negative sample rate.
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775959
CVE-2015-9100
The fill_buffer_resample function in util.c in libmp3lame.a in LAME 3.99.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted audio file.
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=777160
https://bugs.debian.org/cgi-b
Bugzilla
CVE-2015-9099 CVE-2015-9100 CVE-2017-11720 CVE-2017-13712 CVE-2017-15018 CVE-2017-15019 CVE-2017-15045 CVE-2017-15046 CVE-2017-8419 CVE-2017-9410 CVE-2017-9411 CVE-2017-9412 lame: Multiple vulnerabili
bugzilla·2017-07-12·CVSS 5.5
CVE-2015-9099 [MEDIUM] CVE-2015-9099 CVE-2015-9100 CVE-2017-11720 CVE-2017-13712 CVE-2017-15018 CVE-2017-15019 CVE-2017-15045 CVE-2017-15046 CVE-2017-8419 CVE-2017-9410 CVE-2017-9411 CVE-2017-9412 lame: Multiple vulnerabili
CVE-2015-9099 CVE-2015-9100 CVE-2017-11720 CVE-2017-13712 CVE-2017-15018 CVE-2017-15019 CVE-2017-15045 CVE-2017-15046 CVE-2017-8419 CVE-2017-9410 CVE-2017-9411 CVE-2017-9412 lame: Multiple vulnerabilities [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please al
Bugzilla
CVE-2015-9099 CVE-2015-9100 CVE-2017-11720 CVE-2017-13712 CVE-2017-15018 CVE-2017-15019 CVE-2017-15045 CVE-2017-15046 CVE-2017-9410 CVE-2017-9411 CVE-2017-9412 CVE-2017-8419 lame: Multiple vulnerabili
bugzilla·2017-07-12·CVSS 5.5
CVE-2015-9099 [MEDIUM] CVE-2015-9099 CVE-2015-9100 CVE-2017-11720 CVE-2017-13712 CVE-2017-15018 CVE-2017-15019 CVE-2017-15045 CVE-2017-15046 CVE-2017-9410 CVE-2017-9411 CVE-2017-9412 CVE-2017-8419 lame: Multiple vulnerabili
CVE-2015-9099 CVE-2015-9100 CVE-2017-11720 CVE-2017-13712 CVE-2017-15018 CVE-2017-15019 CVE-2017-15045 CVE-2017-15046 CVE-2017-9410 CVE-2017-9411 CVE-2017-9412 CVE-2017-8419 lame: Multiple vulnerabilities [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also m
2017-07-27
Published