OESA-2022-1701

    Dashboard / Vulnerabilities / OESA-2022-1701

    OESA-2022-1701

    Published: 10 Jun 2022Last Modified: 18 Aug 2026
    Upstream:
    CVE-2020-23903

    Summary: speex security update

    Details: Speex is an Open Source/Free Software patent-free audio compression format designed for speech. The Speex Project aims to lower the barrier of entry for voice applications by providing a free alternative to expensive proprietary speech codecs. Moreover, Speex is well-adapted to Internet applications and provides useful features that are not present in most other codecs. Security Fix(es): A Divide by Zero vulnerability in the function static int read_samples of Speex v1.2 allows attackers to cause a denial of service (DoS) via a crafted WAV file.(CVE-2020-23903)

    References: https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1701, https://nvd.nist.gov/vuln/detail/CVE-2020-23903

    Affected packages

    Package

    Name: speex

    Purl: pkg:rpm/openEuler/speex&distro=openEuler-20.03-LTS-SP1

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -1.2.0-5.oe1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    OESA-2022-1701 | CVE-DB