CVE-2014-0045
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2014-0045
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2014-0045.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2014-0045
- Related
- Published
- 2014-02-08T00:55:06Z
- Modified
- 2024-11-22T05:01:15Z
- Summary
- [none]
- Details
-
The needSamples method in AudioOutputSpeech.cpp in the client in Mumble 1.2.4 and the 1.2.3 pre-release snapshots, Mumble for iOS 1.1 through 1.2.2, and MumbleKit before commit fd190328a9b24d37382b269a5674b0c0c7a7e36d does not check the return value of the opusdecodefloat function, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted Opus voice packet, which triggers an error in opusdecodefloat, a conversion of a negative integer to an unsigned integer, and a heap-based buffer over-read and over-write.
- References
-
- http://mumble.info/security/Mumble-SA-2014-004.txt
- http://www.debian.org/security/2014/dsa-2854
- http://lists.opensuse.org/opensuse-updates/2014-02/msg00063.html
- http://mumble.info/security/Mumble-SA-2014-002.txt
- http://osvdb.org/102905
- http://osvdb.org/102958
- http://www.securityfocus.com/bid/65374
- https://security-tracker.debian.org/tracker/CVE-2014-0045
Affected packages
Debian:11 / mumble
Package
- Name
- mumble
- Purl
- pkg:deb/debian/mumble?arch=source
Debian:12 / mumble
Package
- Name
- mumble
- Purl
- pkg:deb/debian/mumble?arch=source
Debian:13 / mumble
Package
- Name
- mumble
- Purl
- pkg:deb/debian/mumble?arch=source