oss-security - Re: CVE id request

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Wed, 7 May 2008 16:35:13 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: Tomas Hoger <thoger@...hat.com>
cc: oss-security@...ts.openwall.com, coley@...re.org
Subject: Re: CVE id request - libid3tag

======================================================
Name: CVE-2008-2109
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2109
Reference: CONFIRM:http://bugs.gentoo.org/show_bug.cgi?id=210564
Reference: MLIST:[mad-dev] 20080112 Initite loop bug in libid3tag-0.15.0b
Reference: URL:http://www.mars.org/mailman/public/mad-dev/2008-January/001366.html

field.c in the libid3tag 0.15.0b library allows context-dependent
attackers to cause a denial of service (CPU consumption) via an
ID3_FIELD_TYPE_STRINGLIST field that ends in '\0', which triggers an
infinite loop.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.