Summary
It was discovered that Libextractor incorrectly handled zero sample rate.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2017-15266)
It was discovered that Libextractor incorrectly handled certain FLAC
metadata. An attacker could possibly use this issue to cause a denial of
service. (CVE-2017-15267)
It was discovered that Libextractor incorrectly handled certain specially
crafted files. An attacker could possibly use this issue to cause a denial
of service. (CVE-2017-15600, CVE-2018-16430, CVE-2018-20430)
It was discovered that Libextractor incorrectly handled certain inputs. An
attacker could possibly use this issue to cause a denial of service.
(CVE-2017-15601)
It was discovered that Libextractor incorrectly handled integers. An
attacker could possibly use this issue to cause a denial of service.
(CVE-2017-15602)
It was discovered that Libextractore incorrectly handled certain crafted
files. An attacker could possibly use this issue to cause a denial of
service. (CVE-2017-15922)
It was discovered tha Libextractor incorrectly handled certain files. An
attacker could possibly use this issue to cause a denial of service.
(CVE-2017-17440)
It was discovered that Libextractor incorrectly handled certain malformed
files. An attacker could possibly use this issue to cause a denial of
service. (CVE-2018-14346)
It was discovered that Libextractor incorrectly handled malformed files. An
attacker could possibly use this issue to cause a denial of service.
(CVE-2018-14347)
It was discovered that Libextractor incorrectly handled metadata. An
attacker could possibly use this issue to cause a denial of service.
(CVE-2018-20431)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | libextractor | 1:1.3-4+deb9u3build0.16.04.1 |
Vulnerabilities 12
-
Unscored —
In GNU Libextractor 1.4, there is a Divide-By-Zero in EXTRACTOR_wav_extract_method in wav_extractor.c via a zero sample…
-
Unscored —
In GNU Libextractor 1.4, there is a NULL Pointer Dereference in flac_metadata in flac_extractor.c.
-
Unscored —
In GNU Libextractor 1.4, there is a NULL Pointer Dereference in the EXTRACTOR_nsf_extract_method function of plugins/ns…
-
Unscored —
In GNU Libextractor 1.4, there is a heap-based buffer overflow in the EXTRACTOR_png_extract_method function in plugins/…
-
Unscored —
In GNU Libextractor 1.4, there is an integer signedness error for the chunk size in the EXTRACTOR_nsfe_extract_method f…
-
Unscored —
In GNU Libextractor 1.4, there is an out-of-bounds read in the EXTRACTOR_dvi_extract_method function in plugins/dvi_ext…
-
Unscored —
GNU Libextractor 1.6 allows remote attackers to cause a denial of service (NULL pointer dereference and application cra…
-
Unscored —
GNU Libextractor before 1.7 has a stack-based buffer overflow in ec_read_file_func (unzip.c).
-
Unscored —
GNU Libextractor before 1.7 contains an infinite loop vulnerability in EXTRACTOR_mpeg_extract_method (mpeg_extractor.c).
-
Unscored —
GNU Libextractor through 1.7 has an out-of-bounds read vulnerability in EXTRACTOR_zip_extract_method() in zip_extractor…
-
Unscored —
GNU Libextractor through 1.8 has an out-of-bounds read vulnerability in the function history_extract() in plugins/ole2_…
-
Unscored —
GNU Libextractor through 1.8 has a NULL Pointer Dereference vulnerability in the function process_metadata() in plugins…
References
-
report
https://ubuntu.com/security/CVE-2017-15266
-
report
https://ubuntu.com/security/CVE-2017-15267
-
report
https://ubuntu.com/security/CVE-2017-15600
-
report
https://ubuntu.com/security/CVE-2017-15601
-
report
https://ubuntu.com/security/CVE-2017-15602
-
report
https://ubuntu.com/security/CVE-2017-15922
-
report
https://ubuntu.com/security/CVE-2017-17440
-
report
https://ubuntu.com/security/CVE-2018-14346
-
report
https://ubuntu.com/security/CVE-2018-14347
-
report
https://ubuntu.com/security/CVE-2018-16430
-
report
https://ubuntu.com/security/CVE-2018-20430
-
report
https://ubuntu.com/security/CVE-2018-20431