CVE-2017-12678

HIGH8.8EPSS 0.36%

taglib - security update

Published: 8/8/2017Modified: 4/28/2026

Description

In TagLib 1.11.1, the rebuildAggregateFrames function in id3v2framefactory.cpp has a pointer to cast vulnerability, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted audio file.

Affected packages (3)

Alpine/taglibfrom 0, < 1.11.1-r2
Debian/taglibfrom 0, < 1.11.1+dfsg.1-0.2
Debian/taglibfrom 0, < 1.11.1+dfsg.1-0.3+deb9u1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References (2)

ADVISORYhttps://security.alpinelinux.org/vuln/CVE-2017-12678
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2017-12678