CVE-2023-43361 Memory corruption in n/a
A local attacker can execute arbitrary code or cause a denial of service via a buffer overflow in Vorbis-tools during WAV to OGG conversion.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-43361?
CVE-2023-43361 is a high-severity memory corruption vulnerability in n/a, published on 2 Oct 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Buffer Overflow vulnerability in Vorbis-tools v.1.4.2 allows a local attacker to execute arbitrary code and cause a denial of service during the conversion of wav files to ogg files.
Weakness: CWE-787
Which versions are affected by CVE-2023-43361?
It affects 1 product.
Linux distribution packages (23)
vorbis-tools AlmaLinux:8 | All versions | 1:1.4.0-29.el8 |
vorbis-tools Red Hat:enterprise_linux:8::appstream | All versions | 1:1.4.0-29.el8 |
vorbis-tools-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:1.4.0-29.el8 |
vorbis-tools-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 1:1.4.0-29.el8 |
vorbis-tools Rocky Linux:8 | All versions | 1:1.4.0-29.el8 |
vorbis-tools SUSE:Enterprise Storage 7.1 | All versions | 1.4.0-150000.3.3.1 |
vorbis-tools SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | All versions | 1.4.0-150000.3.3.1 |
vorbis-tools SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | All versions | 1.4.0-150000.3.3.1 |
vorbis-tools SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS | All versions | 1.4.0-150000.3.3.1 |
vorbis-tools SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | All versions | 1.4.0-150000.3.3.1 |
vorbis-tools SUSE:Linux Enterprise Module for Desktop Applications 15 SP4 | All versions | 1.4.0-150000.3.3.1 |
vorbis-tools SUSE:Linux Enterprise Module for Desktop Applications 15 SP5 | All versions | 1.4.0-150000.3.3.1 |
vorbis-tools SUSE:Linux Enterprise Server 12 SP5 | All versions | 1.4.0-27.3.1 |
vorbis-tools SUSE:Linux Enterprise Server 15 SP1-LTSS | All versions | 1.4.0-150000.3.3.1 |
vorbis-tools SUSE:Linux Enterprise Server 15 SP2-LTSS | All versions | 1.4.0-150000.3.3.1 |
vorbis-tools SUSE:Linux Enterprise Server 15 SP3-LTSS | All versions | 1.4.0-150000.3.3.1 |
vorbis-tools SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 1.4.0-27.3.1 |
vorbis-tools SUSE:Linux Enterprise Server for SAP Applications 15 SP1 | All versions | 1.4.0-150000.3.3.1 |
vorbis-tools SUSE:Linux Enterprise Server for SAP Applications 15 SP2 | All versions | 1.4.0-150000.3.3.1 |
vorbis-tools SUSE:Linux Enterprise Server for SAP Applications 15 SP3 | All versions | 1.4.0-150000.3.3.1 |
vorbis-tools openSUSE:Leap 15.4 | All versions | 1.4.0-150000.3.3.1 |
vorbis-tools openSUSE:Leap 15.5 | All versions | 1.4.0-150000.3.3.1 |
vorbis-tools openSUSE:Tumbleweed | All versions | 1.4.2-2.1 |
Products include Xiph Vorbis-Tools.
How do I fix CVE-2023-43361?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2023-43361 being exploited?
There is no known exploitation of CVE-2023-43361 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as ALSA-2024:3095, AZL-31037, AZL-37055, CLSA-2024-1718896000, CLSA-2024-1718898745, DEBIAN-CVE-2023-43361 and 9 more.