CVE Feed

    Dashboard / CVE / CVE-2017-11333

    CVE-2017-11333

    The vorbis_analysis_wrote function in lib/block.c in Xiph.Org libvorbis 1.3.5 allows remote attackers to cause a denial of service (OOM) via a crafted wav file.

    Published:Jul 30, 2017
    Last Modified:Apr 20, 2025
    EPS:Jul 31, 2017
    EPSS Score:0.01188
    CVSS Score:5.5

    Affected Products

    Vendor
    Xiph.org
    Product
    Libvorbis

    Exploits

    https://www.exploit-db.com/exploits/42399

    Related CVEs

    CVE-2020-20412 (CVSS 6.5) — lib/codebook.c in libvorbis before 1.3.6, as used in StepMania 5.0.12 and other products, has insufficient arr…
    CVE-2018-10392 (CVSS 8.8) — mapping0_forward in mapping0.c in Xiph.Org libvorbis 1.3.6 does not validate the number of channels, which all…
    CVE-2018-10393 (CVSS 7.5) — bark_noise_hybridmp in psy.c in Xiph.Org libvorbis 1.3.6 has a stack-based buffer over-read.…
    CVE-2017-14160 (CVSS 8.8) — The bark_noise_hybridmp function in psy.c in Xiph.Org libvorbis 1.3.5 allows remote attackers to cause a denia…
    CVE-2017-14633 (CVSS 6.5) — In Xiph.Org libvorbis 1.3.5, an out-of-bounds array read vulnerability exists in the function mapping0_forward…
    CVE-2017-14632 (CVSS 9.8) — Xiph.Org libvorbis 1.3.5 allows Remote Code Execution upon freeing uninitialized memory in the function vorbis…
    CVE-2008-2009 (CVSS 4.3) — Xiph.org libvorbis before 1.0 does not properly check for underpopulated Huffman trees, which allows remote at…
    CVE-2008-1420 (CVSS 6.8) — Integer overflow in residue partition value (aka partvals) evaluation in Xiph.org libvorbis 1.2.0 and earlier …
    CVE-2008-1423 (CVSS 9.3) — Integer overflow in a certain quantvals and quantlist calculation in Xiph.org libvorbis 1.2.0 and earlier allo…
    CVE-2008-1419 (CVSS 4.3) — Xiph.org libvorbis 1.2.0 and earlier does not properly handle a zero value for codebook.dim, which allows remo…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High