CVE-2017-15018
LAME 3.99.5, 3.99.4, 3.99.3, 3.99.2, 3.99.1, 3.99, 3.98.4, 3.98.2 and 3.98 have a heap-based...
LAME 3.99.5, 3.99.4, 3.99.3, 3.99.2, 3.99.1, 3.99, 3.98.4, 3.98.2 and 3.98 have a heap-based buffer over-read when handling a malformed file in k_34_4 in vbrquantize.c.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
LAME 3.99.5, 3.99.4, 3.99.3, 3.99.2, 3.99.1, 3.99, 3.98.4, 3.98.2 and 3.98 have a heap-based buffer over-read when handling a malformed file in k_34_4 in vbrquantize.c.
- Record
CVE-2017-15018- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List No score
LAME 3.99.5, 3.99.4, 3.99.3, 3.99.2, 3.99.1, 3.99, 3.98.4, 3.98.2 and 3.98 have a heap-based buffer over-read when handling a malformed file in k_34_4 in vbrquantize.c.
- Record
CVE-2017-15018- Updated
- 2026-11-02
EUVDEUVD-2017-6493 No score
LAME 3.99.5, 3.99.4, 3.99.3, 3.99.2, 3.99.1, 3.99, 3.98.4, 3.98.2 and 3.98 have a heap-based buffer over-read when handling a malformed file in k_34_4 in vbrquantize.c.
- Record
EUVD-2017-6493- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5x59-j3mp-9xgf
LAME 3.99.5, 3.99.4, 3.99.3, 3.99.2, 3.99.1, 3.99, 3.98.4, 3.98.2 and 3.98 have a heap-based...
LAME 3.99.5, 3.99.4, 3.99.3, 3.99.2, 3.99.1, 3.99, 3.98.4, 3.98.2 and 3.98 have a heap-based buffer over-read when handling a malformed file in k_34_4 in vbrquantize.c.
- Record
GHSA-5x59-j3mp-9xgf- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSV
LAME 3.99.5, 3.99.4, 3.99.3, 3.99.2, 3.99.1, 3.99, 3.98.4, 3.98.2 and 3.98 have a heap-based buffer over-read when handling a malformed file in k_34_4 in vbrquantize.c.
- Record
CVE-2017-15018- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-15018
LAME 3.99.5, 3.99.4, 3.99.3, 3.99.2, 3.99.1, 3.99, 3.98.4, 3.98.2 and 3.98 have a heap-based buffer over-read when handling a malformed file in k_34_4 in vbrquantize.c.
- Record
DEBIAN-CVE-2017-15018- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-15018
LAME 3.99.5, 3.99.4, 3.99.3, 3.99.2, 3.99.1, 3.99, 3.98.4, 3.98.2 and 3.98 have a heap-based buffer over-read when handling a malformed file in k_34_4 in vbrquantize.c.
- Record
UBUNTU-CVE-2017-15018- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUSN-4780-1 No score
lame vulnerabilities
It was discovered that LAME incorrectly handled certain audio files. A remote attacker could possibly use this issue to cause a denial of service. Eight vulnerabilities (CVE-2015-9099, CVE-2015-9100, CVE-2015-9101, CVE-2017-15018, CVE-2017-11720, CVE-2017-8419, CVE-2017-9412, CVE-2017-15045) only affected Ubuntu 14.04 ESM, two vulnerabilities (CVE-2017-9410 and CVE-2017-9411) only affected Ubuntu 16.04 ESM, and one vulnerability (CVE-2017-15019) affected both Ubuntu 14.04 ESM and Ubuntu 16.04.
- Record
USN-4780-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
lameDebian:12 |
before 3.99.5+repack1-8 | 3.99.5+repack1-8 |
lameDebian:13 |
before 3.99.5+repack1-8 | 3.99.5+repack1-8 |
lameDebian:14 |
before 3.99.5+repack1-8 | 3.99.5+repack1-8 |
lameUbuntu:Pro:14.04:LTS |
before 3.99.5+repack1-3ubuntu1+esm2, plus listed versions 3.99.5+repack1-33.99.5+repack1-3ubuntu1 |
3.99.5+repack1-3ubuntu1+esm2 |
lameUbuntu:Pro:14.04:LTS From an advisory covering 12 CVEs |
before 3.99.5+repack1-3ubuntu1+esm3, plus listed versions 3.99.5+repack1-33.99.5+repack1-3ubuntu13.99.5+repack1-3ubuntu1+esm2 |
3.99.5+repack1-3ubuntu1+esm3 |
lameUbuntu:Pro:16.04:LTS From an advisory covering 12 CVEs |
before 3.99.5+repack1-9ubuntu0.1~esm2, plus listed versions 3.99.5+repack1-93.99.5+repack1-9build13.99.5+repack1-9ubuntu0.1~esm1 |
3.99.5+repack1-9ubuntu0.1~esm2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-15018 is a medium vulnerability (CVSS 5.5) in Lame Project Lame, published October 4, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.86%, the 58th percentile. Fixed in lame 3.99.5+repack1-8.
References
sourceforge.net/p/lame/bugs/480
nvd.nist.gov/vuln/detail/CVE-2017-15018
github.com/advisories/GHSA-5x59-j3mp-9xgf
security-tracker.debian.org/tracker/CVE-2017-15018
ubuntu.com/security/CVE-2017-15018
cve.org/CVERecord?id=CVE-2017-15018
Show 12 moreShow less