CVE-2008-1420
Integer overflow in residue partition value (aka partvals) evaluation in Xiph.org libvorbis 1.2.0...
Integer overflow in residue partition value (aka partvals) evaluation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to execute arbitrary code via a crafted OGG file, which triggers a heap overflow.
Exploit likelihood
What each source reports
NVD Score used
Integer overflow in residue partition value (aka partvals) evaluation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to execute arbitrary code via a crafted OGG file, which triggers a heap overflow.
- Record
CVE-2008-1420- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-189
- Updated
- 2026-11-02
CVE List No score
Integer overflow in residue partition value (aka partvals) evaluation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to execute arbitrary code via a crafted OGG file, which triggers a heap overflow.
- Record
CVE-2008-1420- Updated
- 2026-11-02
EUVDEUVD-2008-1424 No score
Integer overflow in residue partition value (aka partvals) evaluation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to execute arbitrary code via a crafted OGG file, which triggers a heap overflow.
- Record
EUVD-2008-1424- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3pp3-xmgq-cpcc No score
Integer overflow in residue partition value (aka partvals) evaluation in Xiph.org libvorbis 1.2.0...
Integer overflow in residue partition value (aka partvals) evaluation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to execute arbitrary code via a crafted OGG file, which triggers a heap overflow.
- Record
GHSA-3pp3-xmgq-cpcc- Updated
- 2026-11-02
OSV No score
Integer overflow in residue partition value (aka partvals) evaluation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to execute arbitrary code via a crafted OGG file, which triggers a heap overflow.
- Record
CVE-2008-1420- Updated
- 2026-11-02
OSVDEBIAN-CVE-2008-1420 No score
Integer overflow in residue partition value (aka partvals) evaluation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to execute arbitrary code via a crafted OGG file, which triggers a heap overflow.
- Record
DEBIAN-CVE-2008-1420- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10024-1 No score
libvorbis-devel-1.3.5-2.1 on GA media
These are all security issues fixed in the libvorbis-devel-1.3.5-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10024-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libvorbisDebian:12 |
before 1.2.0.dfsg-3.1 | 1.2.0.dfsg-3.1 |
libvorbisDebian:13 |
before 1.2.0.dfsg-3.1 | 1.2.0.dfsg-3.1 |
libvorbisDebian:14 |
before 1.2.0.dfsg-3.1 | 1.2.0.dfsg-3.1 |
libvorbisDebian:4.0 From an advisory covering 3 CVEs |
before 1.1.2.dfsg-1.4, plus listed versions 1.1.2.dfsg-1.21.1.2.dfsg-1.3 |
1.1.2.dfsg-1.4 |
libvorbisRed Hat:enterprise_linux:3::as From an advisory covering 3 CVEs |
before 1:1.0-10.el3 | 1:1.0-10.el3 |
libvorbis-debuginfoRed Hat:enterprise_linux:3::as From an advisory covering 3 CVEs |
before 1:1.0-10.el3 | 1:1.0-10.el3 |
libvorbis-develRed Hat:enterprise_linux:3::as From an advisory covering 3 CVEs |
before 1:1.0-10.el3 | 1:1.0-10.el3 |
libvorbisRed Hat:enterprise_linux:3::desktop From an advisory covering 3 CVEs |
before 1:1.0-10.el3 | 1:1.0-10.el3 |
libvorbis-debuginfoRed Hat:enterprise_linux:3::desktop From an advisory covering 3 CVEs |
before 1:1.0-10.el3 | 1:1.0-10.el3 |
libvorbis-develRed Hat:enterprise_linux:3::desktop From an advisory covering 3 CVEs |
before 1:1.0-10.el3 | 1:1.0-10.el3 |
Show 35 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libvorbisRed Hat:enterprise_linux:3::es From an advisory covering 3 CVEs |
before 1:1.0-10.el3 | 1:1.0-10.el3 |
libvorbis-debuginfoRed Hat:enterprise_linux:3::es From an advisory covering 3 CVEs |
before 1:1.0-10.el3 | 1:1.0-10.el3 |
libvorbis-develRed Hat:enterprise_linux:3::es From an advisory covering 3 CVEs |
before 1:1.0-10.el3 | 1:1.0-10.el3 |
libvorbisRed Hat:enterprise_linux:3::ws From an advisory covering 3 CVEs |
before 1:1.0-10.el3 | 1:1.0-10.el3 |
libvorbis-debuginfoRed Hat:enterprise_linux:3::ws From an advisory covering 3 CVEs |
before 1:1.0-10.el3 | 1:1.0-10.el3 |
libvorbis-develRed Hat:enterprise_linux:3::ws From an advisory covering 3 CVEs |
before 1:1.0-10.el3 | 1:1.0-10.el3 |
libvorbisRed Hat:enterprise_linux:4::as From an advisory covering 3 CVEs |
before 1:1.1.0-3.el4_6.1 | 1:1.1.0-3.el4_6.1 |
libvorbis-debuginfoRed Hat:enterprise_linux:4::as From an advisory covering 3 CVEs |
before 1:1.1.0-3.el4_6.1 | 1:1.1.0-3.el4_6.1 |
libvorbis-develRed Hat:enterprise_linux:4::as From an advisory covering 3 CVEs |
before 1:1.1.0-3.el4_6.1 | 1:1.1.0-3.el4_6.1 |
libvorbisRed Hat:enterprise_linux:4::desktop From an advisory covering 3 CVEs |
before 1:1.1.0-3.el4_6.1 | 1:1.1.0-3.el4_6.1 |
libvorbis-debuginfoRed Hat:enterprise_linux:4::desktop From an advisory covering 3 CVEs |
before 1:1.1.0-3.el4_6.1 | 1:1.1.0-3.el4_6.1 |
libvorbis-develRed Hat:enterprise_linux:4::desktop From an advisory covering 3 CVEs |
before 1:1.1.0-3.el4_6.1 | 1:1.1.0-3.el4_6.1 |
libvorbisRed Hat:enterprise_linux:4::es From an advisory covering 3 CVEs |
before 1:1.1.0-3.el4_6.1 | 1:1.1.0-3.el4_6.1 |
libvorbis-debuginfoRed Hat:enterprise_linux:4::es From an advisory covering 3 CVEs |
before 1:1.1.0-3.el4_6.1 | 1:1.1.0-3.el4_6.1 |
libvorbis-develRed Hat:enterprise_linux:4::es From an advisory covering 3 CVEs |
before 1:1.1.0-3.el4_6.1 | 1:1.1.0-3.el4_6.1 |
libvorbisRed Hat:enterprise_linux:4::ws From an advisory covering 3 CVEs |
before 1:1.1.0-3.el4_6.1 | 1:1.1.0-3.el4_6.1 |
libvorbis-debuginfoRed Hat:enterprise_linux:4::ws From an advisory covering 3 CVEs |
before 1:1.1.0-3.el4_6.1 | 1:1.1.0-3.el4_6.1 |
libvorbis-develRed Hat:enterprise_linux:4::ws From an advisory covering 3 CVEs |
before 1:1.1.0-3.el4_6.1 | 1:1.1.0-3.el4_6.1 |
libvorbisRed Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs |
before 1:1.1.2-3.el5_1.2 | 1:1.1.2-3.el5_1.2 |
libvorbis-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs |
before 1:1.1.2-3.el5_1.2 | 1:1.1.2-3.el5_1.2 |
libvorbis-develRed Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs |
before 1:1.1.2-3.el5_1.2 | 1:1.1.2-3.el5_1.2 |
libvorbisRed Hat:enterprise_linux:5::client From an advisory covering 3 CVEs |
before 1:1.1.2-3.el5_1.2 | 1:1.1.2-3.el5_1.2 |
libvorbis-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 3 CVEs |
before 1:1.1.2-3.el5_1.2 | 1:1.1.2-3.el5_1.2 |
libvorbisRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs |
before 1:1.1.2-3.el5_1.2 | 1:1.1.2-3.el5_1.2 |
libvorbis-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs |
before 1:1.1.2-3.el5_1.2 | 1:1.1.2-3.el5_1.2 |
libvorbis-develRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs |
before 1:1.1.2-3.el5_1.2 | 1:1.1.2-3.el5_1.2 |
libvorbisRed Hat:enterprise_linux:2.1::as From an advisory covering 4 CVEs |
before 0:1.0rc2-9.el2 | 0:1.0rc2-9.el2 |
libvorbis-develRed Hat:enterprise_linux:2.1::as From an advisory covering 4 CVEs |
before 0:1.0rc2-9.el2 | 0:1.0rc2-9.el2 |
libvorbisRed Hat:enterprise_linux:2.1::aw From an advisory covering 4 CVEs |
before 0:1.0rc2-9.el2 | 0:1.0rc2-9.el2 |
libvorbis-develRed Hat:enterprise_linux:2.1::aw From an advisory covering 4 CVEs |
before 0:1.0rc2-9.el2 | 0:1.0rc2-9.el2 |
libvorbisRed Hat:enterprise_linux:2.1::es From an advisory covering 4 CVEs |
before 0:1.0rc2-9.el2 | 0:1.0rc2-9.el2 |
libvorbis-develRed Hat:enterprise_linux:2.1::es From an advisory covering 4 CVEs |
before 0:1.0rc2-9.el2 | 0:1.0rc2-9.el2 |
libvorbisRed Hat:enterprise_linux:2.1::ws From an advisory covering 4 CVEs |
before 0:1.0rc2-9.el2 | 0:1.0rc2-9.el2 |
libvorbis-develRed Hat:enterprise_linux:2.1::ws From an advisory covering 4 CVEs |
before 0:1.0rc2-9.el2 | 0:1.0rc2-9.el2 |
libvorbisopenSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 1.3.5-2.1 | 1.3.5-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-1420 is a medium vulnerability (CVSS 6.8) in Xiph.org Libvorbis, published May 16, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.32%, the 93rd percentile. Fixed in libvorbis 1.2.0.dfsg-3.1.
References
usn.ubuntu.com/825-1
secunia.com/advisories/30234
redhat.com/support/errata/RHSA-2008-0270.html
bugzilla.redhat.com/show_bug.cgi?id=440706
lists.opensuse.org/opensuse-security-announce/2008-06/msg00001.html
debian.org/security/2008/dsa-1591
Show 45 moreShow less
securitytracker.com/id?1020029
ubuntu.com/usn/USN-682-1
security.gentoo.org/glsa/glsa-200806-09.xml
securityfocus.com/bid/29206
vupen.com/english/advisories/2008/1510/references
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9500
mandriva.com/security/advisories?name=MDVSA-2008:102
exchange.xforce.ibmcloud.com/vulnerabilities/42402
nvd.nist.gov/vuln/detail/CVE-2008-1420
github.com/advisories/GHSA-3pp3-xmgq-cpcc
security-tracker.debian.org/tracker/CVE-2008-1420
access.redhat.com/errata/RHSA-2008:0270
security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0270.json
cve.org/CVERecord?id=CVE-2008-1419
suse.com/security/cve/CVE-2008-1420