oss-security - CVE request: opus codec before 1.0.2

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20121211133225.61874ce6@melee>
Date: Tue, 11 Dec 2012 13:32:25 +0100
From: Hanno Böck <hanno@...eck.de>
To: oss-security@...ts.openwall.com
Subject: CVE request: opus codec before 1.0.2

http://lists.xiph.org/pipermail/opus/2012-December/001846.html

sounds like a low-severity security issue:

"Opus 1.0.2 fixes an out-of-bounds read that could be triggered by a
malicious Opus packet by causing an integer wrap-around in the padding
code. Considering that the packet would have to be at least 16 MB in
size and that no out-of-bounds write is possible, the severity is very
low."

Fixed in opus 1.0.2.

-- 
Hanno Böck		mail/jabber: hanno@...eck.de
GPG: BBB51E42		http://www.hboeck.de/

Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.