This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2017-9872 →

DEBIAN-CVE-2017-9872

The III_dequantize_sample function in layer3.c in mpglib, as used in libmpgdecoder.a in LAME 3.99.5 and other products, allows remote attackers to cau...

Original description

The description as published by the source.

The III_dequantize_sample function in layer3.c in mpglib, as used in libmpgdecoder.a in LAME 3.99.5 and other products, allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted audio file.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 lame

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.99.5+repack1-8"}]}]

Debian:13 lame

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.99.5+repack1-8"}]}]

Debian:14 lame

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.99.5+repack1-8"}]}]

References

advisory security-tracker.debian.org