CVE-2014-9638 | Vulnerability Database | Aqua Security

oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (divide-by-zero error and crash) via a WAV file with the number of channels set to zero.

Affected Software

Name	Vendor	Start Version	End Version
Fedora	Fedoraproject	20 (including)	20 (including)
Fedora	Fedoraproject	21 (including)	21 (including)
Opensuse	Opensuse	13.1 (including)	13.1 (including)
Opensuse	Opensuse	13.2 (including)	13.2 (including)
Vorbis-tools	Ubuntu	lucid	*
Vorbis-tools	Ubuntu	precise	*
Vorbis-tools	Ubuntu	trusty	*
Vorbis-tools	Ubuntu	upstream	*
Vorbis-tools	Ubuntu	utopic	*
Vorbis-tools	Ubuntu	vivid	*
Vorbis-tools	Ubuntu	wily	*

References

http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150543.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150570.html
http://lists.opensuse.org/opensuse-updates/2015-03/msg00054.html
http://seclists.org/fulldisclosure/2015/Jan/78
http://www.openwall.com/lists/oss-security/2015/01/21/5
http://www.openwall.com/lists/oss-security/2015/01/22/9
http://www.securityfocus.com/bid/72290
https://trac.xiph.org/ticket/2137

NVD	https://nvd.nist.gov/vuln/detail/CVE-2014-9638
CWE	https://cwe.mitre.org/data/definitions/NVD-Other.html