CVE-2017-15185
5.0
MEDIUM
CVSS 3.1
EPSS 1.6%
Description
plugins/ogg.c in Libmp3splt 0.9.2 calls the libvorbis vorbis_block_clear function with uninitialized data upon detection of invalid input, which allows remote attackers to cause a denial of service (application crash) via a crafted file.
How to fix CVE-2017-15185
To remediate CVE-2017-15185, upgrade the affected package to a fixed version below.
- Debian/mp3splt—upgrade to 2.6.2+20170630-2 or later
Is CVE-2017-15185 being exploited?
Low — EPSS is 1.6%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 2.6.2+20170630-2
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM5.0 | CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H |