LAME 3.99.5 vulnerabilities
4 known CVE vulnerabilities in LAME 3.99.5, translated and rated.
- CVE-2017-15019High
LAME 3.99.5 has a NULL Pointer Dereference in the hip_decode_init function within libmp3lame/mpglib_interface.c triggered by a malformed mpg file due to an incorrect calloc call.
- CVE-2017-13712High
The id3v2AddAudioDuration function in LAME 3.99.5 has a NULL Pointer Dereference, allowing attackers to trigger Denial of Service by passing NULL as the first argument.
- CVE-2017-8419High
LAME through 3.99.5 relies on the signed integer data type for values in a WAV or AIFF header, allowing remote attackers to cause a denial of service (stack-based buffer overflow or heap-based buffer overflow) or possibly have unspecified other impact via a crafted file.
- CVE-2017-11720Critical
There is a division-by-zero vulnerability in LAME 3.99.5, caused by a malformed input file.