CVE-2017-11720
CriticalSummary
There is a division-by-zero vulnerability in LAME 3.99.5, caused by a malformed input file.
Risk Assessment
An attacker may exploit this vulnerability to cause application crashes, potentially leading to service availability loss.
Recommendation
It is recommended to upgrade to a newer version of LAME that addresses this vulnerability.
Other vulnerabilities in LAME 3.99.5
See all- CVE-2017-15019High
LAME 3.99.5 has a NULL Pointer Dereference in the hip_decode_init function within libmp3lame/mpglib_interface.c triggered by a malformed mpg file due to an incorrect calloc call.
- CVE-2017-13712High
The id3v2AddAudioDuration function in LAME 3.99.5 has a NULL Pointer Dereference, allowing attackers to trigger Denial of Service by passing NULL as the first argument.
- CVE-2017-8419High
LAME through 3.99.5 relies on the signed integer data type for values in a WAV or AIFF header, allowing remote attackers to cause a denial of service (stack-based buffer overflow or heap-based buffer overflow) or possibly have unspecified other impact via a crafted file.
Original NVD description (English source)
There is a division-by-zero vulnerability in LAME 3.99.5, caused by a malformed input file.