CVE-2017-13712
HighSummary
The id3v2AddAudioDuration function in LAME 3.99.5 has a NULL Pointer Dereference, allowing attackers to trigger Denial of Service by passing NULL as the first argument.
Risk Assessment
Attackers can exploit this vulnerability to crash the application, potentially leading to service availability interruptions.
Recommendation
It is recommended to upgrade to a newer version of LAME that addresses this vulnerability to minimize the risk of Denial of Service attacks.
Other vulnerabilities in LAME 3.99.5
See all- CVE-2017-15019High
LAME 3.99.5 has a NULL Pointer Dereference in the hip_decode_init function within libmp3lame/mpglib_interface.c triggered by a malformed mpg file due to an incorrect calloc call.
- CVE-2017-8419High
LAME through 3.99.5 relies on the signed integer data type for values in a WAV or AIFF header, allowing remote attackers to cause a denial of service (stack-based buffer overflow or heap-based buffer overflow) or possibly have unspecified other impact via a crafted file.
- CVE-2017-11720Critical
There is a division-by-zero vulnerability in LAME 3.99.5, caused by a malformed input file.
Original NVD description (English source)
NULL Pointer Dereference in the id3v2AddAudioDuration function in libmp3lame/id3tag.c in LAME 3.99.5 allows attackers to perform Denial of Service by triggering a NULL first argument.