Re: CVE request: two issues in vorbis-tools

[Hanno Böck <hanno () hboeck de>]

On Thu, 22 Jan 2015 11:50:16 -0500 (EST)
cve-assign () mitre org wrote:

> On Wed, 21 Jan 2015, Hanno Böck wrote:
>
> > On Wed, 21 Jan 2015 13:50:46 +0100
> > Martin Prpic <mprpic () redhat com> wrote:
> >
> > > Two issues were reported in vorbis-tools on Full Disclosure:
> > >
> > > http://seclists.org/fulldisclosure/2015/Jan/78
>
> CVE-2014-9638 - https://trac.xiph.org/ticket/2137 (division by zero)
>
> CVE-2014-9639 - https://trac.xiph.org/ticket/2136 (integer overflow)

These two also affect opusenc.
I don't know if this deserves more CVEs, because these issues are
likely minor, but wanted to note it for completeness. It is a
different software package. I'll add comments to the corresponding bug
reports.

-- 
Hanno Böck
http://hboeck.de/

mail/jabber: hanno () hboeck de
GPG: BBB51E42

Attachment: _bin
Description: OpenPGP digital signature