Description
Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in speex_bits_read_whole_bytes() in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speex_bits_init_buffer() or speex_bits_set_bit_buffer() to corrupt heap or stack memory and crash applications.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
xiph speex
Default version status: unaffected
0 to ≤ 1.2.1affected
pkg:github/xiph/speexReferences
- https://github.com/xiph/speex/issues/42 ↗
- https://github.com/xiph/speex ↗
- https://github.com/xiph/speex/blob/Speex-1.2.1/libspeex/bits.c#L177 ↗
- https://hackmd.io/@haindpwn/speex-bits-read-whole-bytes-oob-write ↗
- https://gitlab.xiph.org/xiph/speex/-/merge_requests/32 ↗
- https://www.vulncheck.com/advisories/speex-through-1.2.1-out-of-bounds-write-via-speex-bits-read-whole-bytes ↗