A Segmentation Fault issue discovered StreamSerializer::extractStreams function in streamSerializer.cpp in oggvideotools 0.9.1 allows remote attackers to cause a denial of service (crash) via opening of crafted ogg file.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Ogg_video_tools | Ogg_video_tools_project | 0.9.1 (including) | 0.9.1 (including) |
| Oggvideotools | Ubuntu | bionic | * |
| Oggvideotools | Ubuntu | focal | * |
| Oggvideotools | Ubuntu | lunar | * |
| Oggvideotools | Ubuntu | mantic | * |
| Oggvideotools | Ubuntu | oracular | * |
| Oggvideotools | Ubuntu | plucky | * |
| Oggvideotools | Ubuntu | trusty | * |
| Oggvideotools | Ubuntu | xenial | * |
References
- https://github.com/xiaoxiongwang/security/tree/master/oggvideotools#segv-occurs-in-function-streamserializerextractstreams-in-streamserializercpp
- https://sourceforge.net/p/oggvideotools/bugs/10/
- https://github.com/xiaoxiongwang/security/tree/master/oggvideotools#segv-occurs-in-function-streamserializerextractstreams-in-streamserializercpp
- https://sourceforge.net/p/oggvideotools/bugs/10/