A null pointer dereference issue was discovered in functions op_get_data and op_open1 in opusfile.c in xiph opusfile 0.9 thru 0.12 allows attackers to cause denial of service or other unspecified impacts.
Weakness
The product dereferences a pointer that it expects to be valid but is NULL.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Opusfile | Xiph | 0.9 (including) | 0.12 (including) |
| Opusfile | Ubuntu | bionic | * |
| Opusfile | Ubuntu | esm-apps/bionic | * |
| Opusfile | Ubuntu | esm-apps/focal | * |
| Opusfile | Ubuntu | esm-apps/jammy | * |
| Opusfile | Ubuntu | esm-apps/xenial | * |
| Opusfile | Ubuntu | focal | * |
| Opusfile | Ubuntu | jammy | * |
| Opusfile | Ubuntu | kinetic | * |
| Opusfile | Ubuntu | trusty | * |
| Opusfile | Ubuntu | upstream | * |
| Opusfile | Ubuntu | xenial | * |
Potential Mitigations
References
- https://github.com/xiph/opusfile/commit/0a4cd796df5b030cb866f3f4a5e41a4b92caddf5
- https://github.com/xiph/opusfile/issues/36
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ODIA6QRIRBNF2HRXOE5VCZ2AFP4ZB4R/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4LIKBLOE433RA44YTYUZLED4IOWJG5DV/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ED4CWLBR2WQ2IXXTHZ24UYZBRNCLMJXH/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MYPAQANM2ZNPXRBFOS5NFXNJ7O4Q3OBD/
- https://github.com/xiph/opusfile/commit/0a4cd796df5b030cb866f3f4a5e41a4b92caddf5
- https://github.com/xiph/opusfile/issues/36
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ODIA6QRIRBNF2HRXOE5VCZ2AFP4ZB4R/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4LIKBLOE433RA44YTYUZLED4IOWJG5DV/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ED4CWLBR2WQ2IXXTHZ24UYZBRNCLMJXH/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MYPAQANM2ZNPXRBFOS5NFXNJ7O4Q3OBD/