Log in Start free

Vulnerability · Published Oct 2, 2023 · Assigned by mitre

CVE-2023-43361

High 7.8

In plain English

A high-severity security flaw in the vorbis-tools package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.8High
Exploit odds (30 days)0.4%top 61.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Buffer Overflow vulnerability in Vorbis-tools v.1.4.2 allows a local attacker to execute arbitrary code and cause a denial of service during the conversion of wav files to ogg files.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8vorbis-tools1:1.4.0-29.el8ALSA-2024:3095
Alpine:v3.20vorbis-tools9.54-r1ALPINE-CVE-2023-43361
Alpine:v3.21vorbis-tools9.54-r1ALPINE-CVE-2023-43361
Alpine:v3.22vorbis-tools9.54-r1ALPINE-CVE-2023-43361
Alpine:v3.23vorbis-tools9.54-r1ALPINE-CVE-2023-43361
Alpine:v3.24vorbis-tools9.54-r1ALPINE-CVE-2023-43361
Debian:12vorbis-toolsno fix listedDEBIAN-CVE-2023-43361
Debian:13vorbis-tools1.4.3-1DEBIAN-CVE-2023-43361
Debian:14vorbis-tools1.4.3-1DEBIAN-CVE-2023-43361
Rocky Linux:8vorbis-tools1:1.4.0-29.el8RLSA-2024:3095
Ubuntu:22.04:LTSvorbis-toolsno fix listedUBUNTU-CVE-2023-43361
Ubuntu:24.04:LTSvorbis-toolsno fix listedUBUNTU-CVE-2023-43361
Ubuntu:25.10vorbis-toolsno fix listedUBUNTU-CVE-2023-43361
Ubuntu:26.04:LTSvorbis-toolsno fix listedUBUNTU-CVE-2023-43361
Ubuntu:26.10vorbis-toolsno fix listedUBUNTU-CVE-2023-43361

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References