Skip to content
OpenAdvisories
Unscored USN-4780-1 12 CVEs

lame vulnerabilities

Published Aug 29, 2022 · Updated Jun 29, 2026

Ecosystem: Ubuntu

Summary

It was discovered that LAME incorrectly handled certain audio files. A
remote attacker could possibly use this issue to cause a denial of service. Eight
vulnerabilities (CVE-2015-9099, CVE-2015-9100, CVE-2015-9101, CVE-2017-15018,
CVE-2017-11720, CVE-2017-8419, CVE-2017-9412, CVE-2017-15045) only affected Ubuntu 14.04
ESM, two vulnerabilities (CVE-2017-9410 and CVE-2017-9411) only affected Ubuntu
16.04 ESM, and one vulnerability (CVE-2017-15019) affected both Ubuntu 14.04
ESM and Ubuntu 16.04.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS lame 3.99.5+repack1-3ubuntu1+esm3
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS lame 3.99.5+repack1-9ubuntu0.1~esm2

Vulnerabilities 12

  • Unscored —
    CVE-2015-9099

    The lame_init_params function in lame.c in libmp3lame.a in LAME 3.99.5 allows remote attackers to cause a denial of ser…

    lame lame lame Debian Ubuntu Alpine
  • Unscored —
    CVE-2015-9100

    The fill_buffer_resample function in util.c in libmp3lame.a in LAME 3.99.5 allows remote attackers to cause a denial of…

    lame lame lame Debian Ubuntu Alpine
  • Unscored —
    CVE-2015-9101

    The fill_buffer_resample function in util.c in libmp3lame.a in LAME 3.98.4, 3.98.2, 3.98, 3.99, 3.99.1, 3.99.2, 3.99.3,…

    lame lame Debian Ubuntu
  • Unscored —
    CVE-2017-11720

    There is a division-by-zero vulnerability in LAME 3.99.5, caused by a malformed input file.

    lame lame lame Debian Ubuntu Alpine
  • Unscored —
    CVE-2017-13712

    NULL Pointer Dereference in the id3v2AddAudioDuration function in libmp3lame/id3tag.c in LAME 3.99.5 allows attackers t…

    lame lame Debian Ubuntu
  • Unscored —
    CVE-2017-15018

    LAME 3.99.5, 3.99.4, 3.99.3, 3.99.2, 3.99.1, 3.99, 3.98.4, 3.98.2 and 3.98 have a heap-based buffer over-read when hand…

    lame lame Debian Ubuntu
  • Unscored —
    CVE-2017-15019

    LAME 3.99.5 has a NULL Pointer Dereference in the hip_decode_init function within libmp3lame/mpglib_interface.c via a m…

    lame lame Debian Ubuntu
  • Unscored —
    CVE-2017-15045

    LAME 3.99, 3.99.1, 3.99.2, 3.99.3, 3.99.4, 3.99.5, 3.98.4, 3.98.2 and 3.98 has a heap-based buffer over-read in fill_bu…

    lame lame Debian Ubuntu
  • Unscored —
    CVE-2017-8419

    LAME through 3.99.5 relies on the signed integer data type for values in a WAV or AIFF header, which allows remote atta…

    lame lame Debian Ubuntu
  • Unscored —
    CVE-2017-9410 Public exploit Rejected

    DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2015-9101. Reason: This candidate is a duplicate of CVE-2015-9101. No…

    lame Alpine
  • Unscored —
    CVE-2017-9411 Public exploit Rejected

    DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2015-9100. Reason: This candidate is a duplicate of CVE-2015-9100. No…

    lame Alpine
  • Unscored —
    CVE-2017-9412 Public exploit

    The unpack_read_samples function in frontend/get_audio.c in LAME 3.99.5 allows remote attackers to cause a denial of se…

    lame lame lame Debian Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2015-9099
  • report
    https://ubuntu.com/security/CVE-2015-9100
  • report
    https://ubuntu.com/security/CVE-2015-9101
  • report
    https://ubuntu.com/security/CVE-2017-8419
  • report
    https://ubuntu.com/security/CVE-2017-9410
  • report
    https://ubuntu.com/security/CVE-2017-9411
  • report
    https://ubuntu.com/security/CVE-2017-9412
  • report
    https://ubuntu.com/security/CVE-2017-11720
  • report
    https://ubuntu.com/security/CVE-2017-13712
  • report
    https://ubuntu.com/security/CVE-2017-15018
  • report
    https://ubuntu.com/security/CVE-2017-15019
  • report
    https://ubuntu.com/security/CVE-2017-15045