Xiph Speex vulnerabilities

CVE-2008-1686 [CRITICAL] CWE-189 CVE-2008-1686: Array index vulnerability in Speex 1.1.12 and earlier, as used in libfishsound 0.9.0 and earlier, in Array index vulnerability in Speex 1.1.12 and earlier, as used in libfishsound 0.9.0 and earlier, including Illiminable DirectShow Filters and Annodex Plugins for Firefox, xine-lib before 1.1.12, and many other products, allows remote attackers to execute arbitrary code via a header structure containing a negative offset, which is used to dereferenc

CVE-2020-23903 [MEDIUM] CWE-369 CVE-2020-23903: A Divide by Zero vulnerability in the function static int read_samples of Speex v1.2 allows attacker A Divide by Zero vulnerability in the function static int read_samples of Speex v1.2 allows attackers to cause a denial of service (DoS) via a crafted WAV file.

CVE-2020-23904 [MEDIUM] CWE-787 CVE-2020-23904: A stack buffer overflow in speexenc.c of Speex v1.2 allows attackers to cause a denial of service (D A stack buffer overflow in speexenc.c of Speex v1.2 allows attackers to cause a denial of service (DoS) via a crafted WAV file. NOTE: the vendor states "I cannot reproduce it" and it "is a demo program.