CVE-2019-13223 - Vulnerability Details - OpenCVE

A reachable assertion in the lookup1_values function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service by opening a crafted Ogg Vorbis file.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Debian	Debian Linux
Stb Vorbis Project	Stb Vorbis

Configuration 1 [-]

cpe:2.3:a:stb_vorbis_project:stb_vorbis:*:*:*:*:*:*:*:*

Configuration 2 [-]

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://nothings.org/stb_vorbis/
https://github.com/nothings/stb/commit/98fdfc6df88b1e34a736d5e126e6c8139c8de1a6
https://github.com/nothings/stb/commits/master/stb_vorbis.c
https://lists.debian.org/debian-lts-announce/2023/01/msg00045.html

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2019-08-15T00:00:00

Updated: 2024-08-04T23:49:23.976Z

Reserved: 2019-07-03T00:00:00

Link: CVE-2019-13223

Vulnrichment

No data.

NVD

Status : Modified

Published: 2019-08-15T17:15:13.317

Modified: 2024-11-21T04:24:28.970

Link: CVE-2019-13223

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:stb_vorbis_project:stb_vorbis:*:*:*:*:*:*:*:*", "matchCriteriaId": "258E6E77-C719-4D22-885D-61CEE1EB8844", "versionEndIncluding": "2019-03-04", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A reachable assertion in the lookup1_values function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service by opening a crafted Ogg Vorbis file."}, {"lang": "es", "value": "Una aserci\u00f3n alcanzable en la funci\u00f3n lookup1_values ??en stb_vorbis hasta el 04-03-2019, permite a un atacante causar una denegaci\u00f3n de servicio mediante la apertura de un archivo Ogg Vorbis dise\u00f1ado."}], "id": "CVE-2019-13223", "lastModified": "2024-11-21T04:24:28.970", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-08-15T17:15:13.317", "references": [{"source": "cve@mitre.org", "tags": ["Product"], "url": "http://nothings.org/stb_vorbis/"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "https://github.com/nothings/stb/commit/98fdfc6df88b1e34a736d5e126e6c8139c8de1a6"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "https://github.com/nothings/stb/commits/master/stb_vorbis.c"}, {"source": "cve@mitre.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00045.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product"], "url": "http://nothings.org/stb_vorbis/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/nothings/stb/commit/98fdfc6df88b1e34a736d5e126e6c8139c8de1a6"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/nothings/stb/commits/master/stb_vorbis.c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00045.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-617"}], "source": "nvd@nist.gov", "type": "Primary"}]}