lame vulnerabilities and fixes

Recent CVEs affecting lame, with upgrade or downgrade steps. 15 tracked.

lame has 15 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 1. Most recent: 2017-10-06. Highest priority: CVE-2017-11720 (score 65/100).

• CVE-2017-9872 HIGH 7.8 DOWNGRADE The III_dequantize_sample function in layer3.c in mpglib, as used in libmpgdecoder.a in LAME 3.99.5 and other
• CVE-2017-9871 HIGH 7.8 DOWNGRADE The III_i_stereo function in layer3.c in mpglib, as used in libmpgdecoder.a in LAME 3.99.5 and other products,
• CVE-2017-9870 MEDIUM 5.5 DOWNGRADE The III_i_stereo function in layer3.c in mpglib, as used in libmpgdecoder.a in LAME 3.99.5 and other products,
• CVE-2017-9869 MEDIUM 5.5 DOWNGRADE The II_step_one function in layer2.c in mpglib, as used in libmpgdecoder.a in LAME 3.99.5 and other products,
• CVE-2017-9412 MEDIUM 5.5 DOWNGRADE The unpack_read_samples function in frontend/get_audio.c in LAME 3.99.5 allows remote attackers to cause a den
• CVE-2017-8419 HIGH 7.8 UPGRADE LAME through 3.99.5 relies on the signed integer data type for values in a WAV or AIFF header, which allows re
• CVE-2017-15046 MEDIUM 5.5 DOWNGRADE LAME 3.99.5, 3.99.4, 3.98.4, 3.98.2, 3.98 and 3.97 have a stack-based buffer overflow in unpack_read_samples i
• CVE-2017-15045 MEDIUM 5.5 DOWNGRADE LAME 3.99, 3.99.1, 3.99.2, 3.99.3, 3.99.4, 3.99.5, 3.98.4, 3.98.2 and 3.98 has a heap-based buffer over-read i
• CVE-2017-15019 HIGH 7.8 DOWNGRADE LAME 3.99.5 has a NULL Pointer Dereference in the hip_decode_init function within libmp3lame/mpglib_interface.
• CVE-2017-15018 MEDIUM 5.5 DOWNGRADE LAME 3.99.5, 3.99.4, 3.99.3, 3.99.2, 3.99.1, 3.99, 3.98.4, 3.98.2 and 3.98 have a heap-based buffer over-read
• CVE-2017-13712 HIGH 7.5 DOWNGRADE NULL Pointer Dereference in the id3v2AddAudioDuration function in libmp3lame/id3tag.c in LAME 3.99.5 allows at
• CVE-2017-11720 CRITICAL 9.8 DOWNGRADE There is a division-by-zero vulnerability in LAME 3.99.5, caused by a malformed input file.
• CVE-2015-9101 MEDIUM 5.5 DOWNGRADE The fill_buffer_resample function in util.c in libmp3lame.a in LAME 3.98.4, 3.98.2, 3.98, 3.99, 3.99.1, 3.99.2
• CVE-2015-9100 MEDIUM 5.5 DOWNGRADE The fill_buffer_resample function in util.c in libmp3lame.a in LAME 3.99.5 allows remote attackers to cause a
• CVE-2015-9099 MEDIUM 5.5 DOWNGRADE The lame_init_params function in lame.c in libmp3lame.a in LAME 3.99.5 allows remote attackers to cause a deni

FAQ

How do I fix lame vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is lame being exploited right now?

None of the tracked lame CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which lame CVE should I patch first?

CVE-2017-11720 currently ranks highest (65/100): There is a division-by-zero vulnerability in LAME 3.99.5, caused by a malformed input file..

RSS feed for lame · ← Back to latest CVEs