Description
Array index vulnerability in Speex 1.1.12 and earlier, as used in libfishsound 0.9.0 and earlier, including Illiminable DirectShow Filters and Annodex Plugins for Firefox, xine-lib before 1.1.12, and many other products, allows remote attackers to execute arbitrary code via a header structure containing a negative offset, which is used to dereference a function pointer.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libfishsound | 0.7.0-2.2 | — |
| Debian 14 | speex | 1.2~beta2-1 | — |
| Debian 13 | libfishsound | 0.7.0-2.2 | — |
| Debian 13 | speex | 1.2~beta2-1 | — |
| Debian 12 | libfishsound | 0.7.0-2.2 | — |
| Debian 12 | speex | 1.2~beta2-1 | — |
| Debian 5.0 | libfishsound | 0.7.0-2.1+lenny1 | DTSA-127-1 |
| Debian 5.0 | speex | 1.1.12-3+lenny1 | DTSA-129-1 |
| Debian 5.0 | xine-lib | 1.1.10.1-2+lenny2 | DTSA-128-1 |
| Debian 4.0 | libfishsound | 0.7.0-2etch1 | DSA-1584-1 |
| Debian 4.0 | speex | 1.1.12-3etch1 | DSA-1585-1 |
| Debian 4.0 | xine-lib | 1.1.2+dfsg-7 | DSA-1586-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | speex +1 | 1.0.5-4.el5_1.1 | RHSA-2008:0235 |
| RHEL 4 | speex +1 | 1.0.4-4.el4_6.1 | RHSA-2008:0235 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | gstreamer-plugins-good | 1.18.5-2.1 | openSUSE-SU-2024:10829-1 |
| openSUSE Tumbleweed | vorbis-tools | 1.4.2-1.6 | openSUSE-SU-2024:11503-1 |
Advisories 9
- RHSA-2008:0235 Red Hat Security Advisory: speex security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1586-1 xine-lib - multiple vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-127-1 libfishsound - insufficient boundary check Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1584-1 libfishsound - integer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-128-1 xine-lib - multiple vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-129-1 speex - insufficient boundary check Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1585-1 speex - integer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11503-1 vorbis-tools-1.4.2-1.6 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10829-1 gstreamer-plugins-good-1.18.5-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- USN-611-1 vendor-advisory
- http://sourceforge.net/project/shownotes.php?release_id=592185
- 20080417 [oCERT-2008-004] multiple speex implementations insufficientboundary checks mailing-list
- ADV-2008-1302 vdb-entry
- MDVSA-2008:124 vendor-advisory
- 1019875 vdb-entry
- 29878 third-party-advisory
- 29898 third-party-advisory
- FEDORA-2008-3103 vendor-advisory
- ADV-2008-1269 vdb-entry
- 29866 third-party-advisory
- DSA-1586 vendor-advisory
- 30117 third-party-advisory
- [Speex-dev] 20080406 libfishsound 0.9.1 Release mailing-list
- 30104 third-party-advisory
- ADV-2008-1300 vdb-entry
- 29727 third-party-advisory
- ADV-2008-1301 vdb-entry
- USN-611-3 vendor-advisory
- 29672 third-party-advisory
- SUSE-SR:2008:012 vendor-advisory
- DSA-1585 vendor-advisory
- MDVSA-2008:092 vendor-advisory
- 30353 third-party-advisory
- fishsound-libfishsound-speex-bo(41684) vdb-entry
- 29835 third-party-advisory
- http://sourceforge.net/project/shownotes.php?release_id=592185&group_id=9655
- 29880 third-party-advisory
- http://blog.kfish.org/2008/04/release-libfishsound-091.html
- 31393 third-party-advisory
- oval:org.mitre.oval:def:10026 vdb-entry signature
- http://www.ocert.org/advisories/ocert-2008-2.html
- ADV-2008-1228 vdb-entry
- DSA-1584 vendor-advisory
- http://www.ocert.org/advisories/ocert-2008-004.html
- ADV-2008-1268 vdb-entry
- 29845 third-party-advisory
- USN-611-2 vendor-advisory
- RHSA-2008:0235 vendor-advisory
- 30358 third-party-advisory
- 29854 third-party-advisory
- SSA:2008-111-01 vendor-advisory
- ADV-2008-1187 vdb-entry
- MDVSA-2008:094 vendor-advisory
- 29881 third-party-advisory
- MDVSA-2008:093 vendor-advisory
- GLSA-200804-17 vendor-advisory
- 30119 third-party-advisory
- 28665 vdb-entry
- http://www.metadecks.org/software/sweep/news.html
- FEDORA-2008-3191 vendor-advisory
- FEDORA-2008-3059 vendor-advisory
- 29882 third-party-advisory
- USN-635-1 vendor-advisory
- 30337 third-party-advisory
- 30581 third-party-advisory
- SUSE-SR:2008:013 vendor-advisory
- 30717 third-party-advisory