CVE-2018-10392 Memory corruption in n/a
Remote attackers can cause denial of service or potentially execute code via a crafted audio file due to improper channel validation in libvorbis.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2018-10392?
CVE-2018-10392 is a high-severity memory corruption vulnerability in Debian Debian Linux, published on 26 Apr 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
mapping0_forward in mapping0.c in Xiph.Org libvorbis 1.3.6 does not validate the number of channels, which allows remote attackers to cause a denial of service (heap-based buffer overflow or over-read) or possibly have unspecified other impact via a crafted file.
Which versions are affected by CVE-2018-10392?
It affects 6 products.
Linux distribution packages (8)
libvorbis SUSE:Linux Enterprise Desktop 12 SP3 | All versions | 1.3.3-10.14.1 |
libvorbis SUSE:Linux Enterprise Module for Basesystem 15 | All versions | 1.3.6-4.3.1 |
libvorbis SUSE:Linux Enterprise Server 11 SP4 | All versions | 1.2.0-79.20.14.1 |
libvorbis SUSE:Linux Enterprise Server 12 SP3 | All versions | 1.3.3-10.14.1 |
libvorbis SUSE:Linux Enterprise Server for SAP Applications 11 SP4 | All versions | 1.2.0-79.20.14.1 |
libvorbis SUSE:Linux Enterprise Server for SAP Applications 12 SP3 | All versions | 1.3.3-10.14.1 |
libvorbis SUSE:Linux Enterprise Software Development Kit 11 SP4 | All versions | 1.2.0-79.20.14.1 |
libvorbis SUSE:Linux Enterprise Software Development Kit 12 SP3 | All versions | 1.3.3-10.14.1 |
Products include Debian Debian Linux, Redhat Enterprise Linux, Redhat Enterprise Linux Eus, Redhat Enterprise Linux Server Aus, Redhat Enterprise Linux Server Tus, Xiph.org Libvorbis.
How do I fix CVE-2018-10392?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2018-10392 being exploited?
There is no known exploitation of CVE-2018-10392 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2018-10392, AZL-7276, DEBIAN-CVE-2018-10392, GHSA-gqh4-wfj8-7856, SUSE-SU-2018:1563-1, SUSE-SU-2018:1565-1 and 2 more.