Every CVE Search/ Get API key

CVE-2004-2779

id3_utf16_deserialize() in utf16.c in libid3tag through 0.15.1b misparses ID3v2 tags encoded in...

7.5 HighFix available

id3_utf16_deserialize() in utf16.c in libid3tag through 0.15.1b misparses ID3v2 tags encoded in UTF-16 with an odd number of bytes, triggering an endless loop allocating memory until an OOM condition is reached, leading to denial-of-service (DoS).

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

2.46%Up 1.5 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

id3_utf16_deserialize() in utf16.c in libid3tag through 0.15.1b misparses ID3v2 tags encoded in UTF-16 with an odd number of bytes, triggering an endless loop allocating memory until an OOM condition is reached, leading to denial-of-service (DoS).

Record
CVE-2004-2779
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-399
Updated
2026-11-02
CVE List No score

id3_utf16_deserialize() in utf16.c in libid3tag through 0.15.1b misparses ID3v2 tags encoded in UTF-16 with an odd number of bytes, triggering an endless loop allocating memory until an OOM condition is reached, leading to denial-of-service (DoS).

Record
CVE-2004-2779
Updated
2026-11-02
EUVDEUVD-2004-2769 No score

id3_utf16_deserialize() in utf16.c in libid3tag through 0.15.1b misparses ID3v2 tags encoded in UTF-16 with an odd number of bytes, triggering an endless loop allocating memory until an OOM condition is reached, leading to denial-of-service (DoS).

Record
EUVD-2004-2769
Updated
2026-11-03
GitHub AdvisoriesGHSA-3qq6-672j-jx3v 7.5

id3_utf16_deserialize() in utf16.c in libid3tag through 0.15.1b misparses ID3v2 tags encoded in...

id3_utf16_deserialize() in utf16.c in libid3tag through 0.15.1b misparses ID3v2 tags encoded in UTF-16 with an odd number of bytes, triggering an endless loop allocating memory until an OOM condition is reached, leading to denial-of-service (DoS).

Record
GHSA-3qq6-672j-jx3v
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-36950 7.5

CVE-2004-2779 affecting package libid3tag for versions less than 0.16.3-7

id3_utf16_deserialize() in utf16.c in libid3tag through 0.15.1b misparses ID3v2 tags encoded in UTF-16 with an odd number of bytes, triggering an endless loop allocating memory until an OOM condition is reached, leading to denial-of-service (DoS).

Record
AZL-36950
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-7261 7.5

CVE-2004-2779 affecting package libid3tag 0.15.1b-33

id3_utf16_deserialize() in utf16.c in libid3tag through 0.15.1b misparses ID3v2 tags encoded in UTF-16 with an odd number of bytes, triggering an endless loop allocating memory until an OOM condition is reached, leading to denial-of-service (DoS).

Record
AZL-7261
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 6 moreShow less
OSV 7.5

id3_utf16_deserialize() in utf16.c in libid3tag through 0.15.1b misparses ID3v2 tags encoded in UTF-16 with an odd number of bytes, triggering an endless loop allocating memory until an OOM condition is reached, leading to denial-of-service (DoS).

Record
CVE-2004-2779
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2004-2779 7.5

id3_utf16_deserialize() in utf16.c in libid3tag through 0.15.1b misparses ID3v2 tags encoded in UTF-16 with an odd number of bytes, triggering an endless loop allocating memory until an OOM condition is reached, leading to denial-of-service (DoS).

Record
DEBIAN-CVE-2004-2779
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVMGASA-2018-0223 No score

Updated libid3tag packages fix security vulnerabilities

id3_utf16_deserialize() in utf16.c in libid3tag through 0.15.1b misparses ID3v2 tags encoded in UTF-16 with an odd number of bytes, triggering an endless loop allocating memory until an OOM condition is reached, leading to denial-of-service (DoS). (CVE-2004-2779)

field.c in the libid3tag 0.15.0b library allows context-dependent attackers to cause a denial of service (CPU consumption) via an ID3_FIELD_TYPE_STRINGLIST field that ends in '\0', which triggers an infinite loop. (CVE-2008-2109)

The id3_ucs4_length function in ucs4.c in libid3tag 0.15.1b allows remote attackers to cause a denial of service (NULL Pointer Dereference and application crash) via a crafted mp3 file. (CVE-2017-11550)

The id3_field_parse function in field.c in libid3tag 0.15.1b allows remote attackers to cause a denial of service (OOM) via a crafted MP3 file. (CVE-2017-11551)

Record
MGASA-2018-0223
Updated
2026-11-02
OSVopenSUSE-SU-2024:10948-1 No score

libid3tag-devel-0.15.1b-188.15 on GA media

These are all security issues fixed in the libid3tag-devel-0.15.1b-188.15 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10948-1
Updated
2026-11-02
OSVSUSE-SU-2018:0715-1 No score

Security update for libid3tag

This update for libid3tag fixes the following issues:

  • CVE-2004-2779 CVE-2017-11551: Fixed id3_utf16_deserialize() in utf16.c, which previously misparsed ID3v2 tags encoded in UTF-16 with an odd number of bytes, triggering an endless loop allocating memory until OOM leading to DoS. (bsc#1081959 bsc#1081961)
  • CVE-2017-11550 CVE-2008-2109: Fixed the handling of unknown encodings when parsing ID3 tags. (bsc#1081962 bsc#387731)
Record
SUSE-SU-2018:0715-1
Updated
2026-11-02
OSVSUSE-SU-2018:0722-1 No score

Security update for libid3tag

This update for libid3tag fixes the following issues:

  • CVE-2004-2779 CVE-2017-11551: Fixed id3_utf16_deserialize() in utf16.c, which previously misparsed ID3v2 tags encoded in UTF-16 with an odd number of bytes, triggering an endless loop allocating memory until OOM leading to DoS. (bsc#1081959 bsc#1081961)
  • CVE-2017-11550 CVE-2008-2109: Fixed the handling of unknown encodings when parsing ID3 tags. (bsc#1081962 bsc#387731)
Record
SUSE-SU-2018:0722-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libid3tag
Azure Linux:3
 before 0.16.3-7
0.16.3-7
libid3tag
Azure Linux:2
 through 0.15.1b-33 None known
libid3tag
Debian:12
 before 0.15.1b-5
0.15.1b-5
libid3tag
Debian:13
 before 0.15.1b-5
0.15.1b-5
libid3tag
Debian:14
 before 0.15.1b-5
0.15.1b-5
libid3tag
Mageia:5
 before 0.15.1b-16.2.mga5
0.15.1b-16.2.mga5
libid3tag
Mageia:6
 before 0.15.1b-17.2.mga6
0.15.1b-17.2.mga6
libid3tag
SUSE:Linux Enterprise Software Development Kit 11 SP4
 before 0.15.1b-132.3.1
0.15.1b-132.3.1
libid3tag
SUSE:Linux Enterprise Desktop 12 SP2
 before 0.15.1b-184.3.1
0.15.1b-184.3.1
libid3tag
SUSE:Linux Enterprise Desktop 12 SP3
 before 0.15.1b-184.3.1
0.15.1b-184.3.1
Show 4 moreShow less
Affected packages
PackageAffectedFixed
libid3tag
SUSE:Linux Enterprise Software Development Kit 12 SP2
 before 0.15.1b-184.3.1
0.15.1b-184.3.1
libid3tag
SUSE:Linux Enterprise Software Development Kit 12 SP3
 before 0.15.1b-184.3.1
0.15.1b-184.3.1
libid3tag
SUSE:Linux Enterprise Workstation Extension 12 SP2
 before 0.15.1b-184.3.1
0.15.1b-184.3.1
libid3tag
SUSE:Linux Enterprise Workstation Extension 12 SP3
 before 0.15.1b-184.3.1
0.15.1b-184.3.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2004-2779 is a high vulnerability (CVSS 7.5) in Underbit Libid3tag, published February 20, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.46%, the 84th percentile. Fixed in libid3tag 0.16.3-7.

References

Show 12 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open