According to the versions of the libvorbis packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - bark_noise_hybridmp in psy.c in Xiph.Org libvorbis     1.3.6 has a stack-based buffer     over-read.(CVE-2018-10393)

  - The bark_noise_hybridmp function in psy.c in Xiph.Org     libvorbis 1.3.5 allows remote attackers to cause a     denial of service (out-of-bounds access and application     crash) or possibly have unspecified other impact via a     crafted mp4 file.(CVE-2017-14160)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Fedora 28 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2018-0259281ab6 advisory.

    Sync with git (CVE-2017-14160, CVE-2018-10392, CVE-2018-10393, bz#1516379)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 29 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2019-2e385f97e2 advisory.

    MinGW cross compiled libvorbis 1.3.6 + various patches backported from git.

    This is a security fix for: CVE-2017-11333 CVE-2017-11735 CVE-2017-14160 CVE-2017-14632 CVE-2017-14633     CVE-2018-5146 CVE-2018-10392 CVE-2018-10393

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libvorbis package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - bark_noise_hybridmp in psy.c in Xiph.Org libvorbis     1.3.6 has a stack-based buffer     over-read.(CVE-2018-10393)

  - mapping0_forward in mapping0.c in Xiph.Org libvorbis     1.3.6 does not validate the number of channels, which     allows remote attackers to cause a denial of service     (heap-based buffer overflow or over-read) or possibly     have unspecified other impact via a crafted     file.(CVE-2018-10392)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-3703 advisory.

    [1.3.6-2]
    - Sync with git for CVE-2017-14160, CVE-2018-10392, CVE-2018-10393

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several issues have been found in libvorbis, a decoder library for Vorbis General Audio Compression Codec.

The fix for CVE-2017-14160 and CVE-2018-10393 improve the bound checking for very low sample rates.

CVE-2018-10392 was found because the number of channels was not validated and a remote attacker could cause a denial of service.

For Debian 8 'Jessie', these problems have been fixed in version 1.3.4-2+deb8u2.

We recommend that you upgrade your libvorbis packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libvorbis package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - bark_noise_hybridmp in psy.c in Xiph.Org libvorbis     1.3.6 has a stack-based buffer     over-read.(CVE-2018-10393)

  - mapping0_forward in mapping0.c in Xiph.Org libvorbis     1.3.6 does not validate the number of channels, which     allows remote attackers to cause a denial of service     (heap-based buffer overflow or over-read) or possibly     have unspecified other impact via a crafted     file.(CVE-2018-10392)

  - The bark_noise_hybridmp function in psy.c in Xiph.Org     libvorbis 1.3.5 allows remote attackers to cause a     denial of service (out-of-bounds access and application     crash) or possibly have unspecified other impact via a     crafted mp4 file.(CVE-2017-14160)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2828 advisory.

    Several vulnerabilities were fixed in libvorbis, a popular library for the Vorbis audio codec.
    CVE-2017-14160 CVE-2018-10393 Improve bound checking for very low sample rates. CVE-2018-10392 Validate     the number of channels in vorbisenc.c For Debian 9 stretch, these problems have been fixed in version     1.3.5-4+deb9u3. We recommend that you upgrade your libvorbis packages. For the detailed security status of     libvorbis please refer to its security tracker page at: https://security-     tracker.debian.org/tracker/libvorbis Further information about Debian LTS security advisories, how to     apply these updates to your system and frequently asked questions can be found at:
    https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for libvorbis fixes the following issues :

Security issues fixed :

  - CVE-2018-10393: Fixed stack-based buffer over-read in     bark_noise_hybridm (bsc#1091072).

  - CVE-2017-14160: Fixed out-of-bounds access inside     bark_noise_hybridmp function (bsc#1059812).

This update was imported from the SUSE:SLE-12:Update update project.

远程 Oracle Linux 8 主机上安装的程序包受到 ELSA-2019-3703 公告中提及的多个漏洞的影响。

  - Xiph.Org libvorbis 1.3.6 的 mapping0.c 中的 mapping0_forward 不会验证通道数量，从而允许远程攻击者通过构建的文件造成拒绝服务（基于堆的缓冲区溢出或读取越界），或可能造成其他不明影响。(CVE-2018-10392)

  - Xiph.Org libvorbis 1.3.6 的 psy.c 的 bark_noise_hybridmp 中存在基于堆栈的缓冲区读取越界漏洞。
    (CVE-2018-10393)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

libvorbis（Vorbis 通用音频压缩编解码器的一种解码器库）中发现多个问题。CVE-2017-14160 和 CVE-2018-10393 的修复改进了超低采样率下的边界检查。CVE-2018-10392 被发现的原因在于信道数量未验证，远程攻击者可能会造成拒绝服务。对于Debian 8 'Jessie'，这些问题已在 1.3.4-2+deb8u2 版本中修复。我们建议您升级 libvorbis 程序包。注意：Tenable Network Security 已直接从 DLA 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

根据安装的 libvorbis 程序包版本，远程主机上的 EulerOS Virtualization for ARM 64 安装会受到下列漏洞影响：- 在 Xiph.Org libvorbis 1.3.6 的 psy.c 中，bark_noise_hybridmp 存在一个基于堆栈的缓冲区过度读取。(CVE-2018-10393) - 在 Xiph.Org libvorbis 1.3.6 的 mapping0.c 中，mapping0_forward 未验证通道数目，进而允许远程攻击者通过特制的文件，造成拒绝服务（基于堆的缓冲区溢出或过度读取），或可能造成其他不明影响。(CVE-2018-10392) - 在 Xiph.Org libvorbis 1.3.5 的 psy.c 中，bark_noise_hybridmp 函数允许远程攻击者通过特制的 mp4 文件，造成拒绝服务（越界访问和应用程序崩溃），或可能造成其他不明影响。(CVE-2017-14160) 请注意，Tenable Network Security 已直接从 EulerOS 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

远程 Debian 9 主机上安装的多个程序包受到 dla-2828 公告中提及的多个漏洞影响。

  - Xiph.Org libvorbis 1.3.5 的 psy.c 中的 bark_noise_hybridmp 函数允许远程攻击者通过构建的 mp4 文件造成拒绝服务（越界访问和应用程序崩溃），或可能造成其他不明影响。(CVE-2017-14160)

  - Xiph.Org libvorbis 1.3.6 的 mapping0.c 中的 mapping0_forward 不会验证通道数量，从而允许远程攻击者通过构建的文件造成拒绝服务（基于堆的缓冲区溢出或读取越界），或可能造成其他不明影响。(CVE-2018-10392)

  - Xiph.Org libvorbis 1.3.6 的 psy.c 的 bark_noise_hybridmp 中存在基于堆栈的缓冲区读取越界漏洞。
    (CVE-2018-10393)

请注意，Nessus 尚未测试此问题，而是只依据应用程序自我报告的版本号进行判断。

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
152331	EulerOS 2.0 SP9 : libvorbis (EulerOS-SA-2021-2248)	Nessus	Huawei Local Security Checks	2021/8/9	2023/12/6	high
120203	Fedora 28 : libvorbis (2018-0259281ab6)	Nessus	Fedora Local Security Checks	2019/1/3	2025/8/29	critical
121318	Fedora 29 : mingw-libvorbis (2019-2e385f97e2)	Nessus	Fedora Local Security Checks	2019/1/23	2025/8/29	critical
140147	EulerOS 2.0 SP5 : libvorbis (EulerOS-SA-2020-1926)	Nessus	Huawei Local Security Checks	2020/9/2	2024/2/22	high
180701	Oracle Linux 8 : libvorbis (ELSA-2019-3703)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/11/1	high
131431	Debian DLA-2013-1 : libvorbis security update	Nessus	Debian Local Security Checks	2019/12/3	2024/4/9	high
131510	EulerOS Virtualization for ARM 64 3.0.3.0 : libvorbis (EulerOS-SA-2019-2345)	Nessus	Huawei Local Security Checks	2019/12/3	2024/4/8	high
155711	Debian DLA-2828-1 : libvorbis - LTS security update	Nessus	Debian Local Security Checks	2021/11/29	2025/1/24	high
109932	openSUSE Security Update : libvorbis (openSUSE-2018-472)	Nessus	SuSE Local Security Checks	2018/5/21	2024/10/4	high
180701	Oracle Linux 8：libvorbis (ELSA-2019-3703)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/11/1	high
131431	Debian DLA-2013-1：libvorbis 安全更新	Nessus	Debian Local Security Checks	2019/12/3	2024/4/9	high
131510	EulerOS Virtualization for ARM 64 3.0.3.0：libvorbis (EulerOS-SA-2019-2345)	Nessus	Huawei Local Security Checks	2019/12/3	2024/4/8	high
155711	Debian DLA-2828-1：libvorbis - LTS 安全更新	Nessus	Debian Local Security Checks	2021/11/29	2025/1/24	high

检测

插件搜索

high

critical

critical

high

high

high

high

high

high

high

high

high

high