CVE-2009-3379

Description

Multiple unspecified vulnerabilities in libvorbis, as used in Mozilla Firefox 3.5.x before 3.5.4, allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unknown vectors. NOTE: this might overlap CVE-2009-2663.

How to fix CVE-2009-3379

To remediate CVE-2009-3379, upgrade the affected package to a fixed version below.

• Debian/libvorbis—upgrade to 1.2.3-1 or later
• Debian/libvorbisidec—upgrade to 1.0.2+svn18153-0.1 or later

Is CVE-2009-3379 being exploited?

Moderate — EPSS is 5.4%. Track this CVE but it's not at the top of the prioritisation list.

Affected packages (2)

• from 0, < 1.2.3-1
• from 0, < 1.0.2+svn18153-0.1

References (1)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2009-3379