Title: 'libid3tag' Denial of Service Vulnerability
Severity: MODERATE
Description:
The 'libid3tag' library is used for manipulating ID3 tags.
The library is prone to a denial-of-service vulnerability that occurs when it parses the 'ID3_FIELD_TYPE_STRINGLIST' field. Specifically, input ended with the '\0' characters will cause an infinite loop.
An attacker can exploit this issue to cause denial-of-service conditions in applications using a vulnerable version of the library.
The issue affects libid3tag 0.15.0b; other versions may also be vulnerable.
Affected Products:
- Gentoo Linux
- MandrakeSoft Corporate Server 3.0.0
- MandrakeSoft Corporate Server 3.0.0 x86_64
- MandrakeSoft Linux Mandrake 2008.0
- MandrakeSoft Linux Mandrake 2008.0 x86_64
- MandrakeSoft Linux Mandrake 2008.1
- MandrakeSoft Linux Mandrake 2008.1 x86_64
- RedHat Fedora 7
- RedHat Fedora 8
- RedHat Fedora 9
- Underbit Technologies libid3tag 0.15.0b
References:
- Kentaro Oda: [mad-dev] Initite loop bug in libid3tag-0.15.0b
- Underbit Technologies: Vendor Homepage
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
