Description
Xiph.org libvorbis before 1.0 does not properly check for underpopulated Huffman trees, which allows remote attackers to cause a denial of service (crash) via a crafted OGG file that triggers memory corruption during execution of the _make_decode_tree function.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libvorbis | 1.2.0.dfsg-4 | — |
| Debian 14 | libvorbisidec | 1.0.2+svn18153-0.1 | — |
| Debian 13 | libvorbis | 1.2.0.dfsg-4 | — |
| Debian 13 | libvorbisidec | 1.0.2+svn18153-0.1 | — |
| Debian 12 | libvorbis | 1.2.0.dfsg-4 | — |
| Debian 12 | libvorbisidec | 1.0.2+svn18153-0.1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 2 | libvorbis +1 | 1.0rc2-9.el2 | RHSA-2008:0271 |
Advisories 1
- RHSA-2008:0271 Red Hat Security Advisory: libvorbis security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
References
- https://bugzilla.redhat.com/show_bug.cgi?id=444443
- RHSA-2008:0271 vendor-advisory
- 1020029 vdb-entry
- USN-861-1 vendor-advisory
- ADV-2008-1510 vdb-entry
- 30247 third-party-advisory
- libvorbis-makedecodetree-dos(42521) vdb-entry