Every CVE Search/ Get API key

CVE-2017-8372

The mad_layer_III function in layer3.c in Underbit MAD libmad 0.15.1b, if NDEBUG is omitted,...

4.7 MediumFix available

The mad_layer_III function in layer3.c in Underbit MAD libmad 0.15.1b, if NDEBUG is omitted, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted audio file.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

2.07%Up 0.8 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 4.7

The mad_layer_III function in layer3.c in Underbit MAD libmad 0.15.1b, if NDEBUG is omitted, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted audio file.

Record
CVE-2017-8372
CVSS 3.0
4.7 MediumCVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0
2.6 LowAV:N/AC:H/Au:N/C:N/I:N/A:P
Weakness
CWE-617
Updated
2026-11-02
CVE List No score

The mad_layer_III function in layer3.c in Underbit MAD libmad 0.15.1b, if NDEBUG is omitted, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted audio file.

Record
CVE-2017-8372
Updated
2026-11-02
EUVDEUVD-2017-17331 No score

The mad_layer_III function in layer3.c in Underbit MAD libmad 0.15.1b, if NDEBUG is omitted, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted audio file.

Record
EUVD-2017-17331
Updated
2026-11-03
GitHub AdvisoriesGHSA-qpg8-8vx5-pf3q 4.7

The mad_layer_III function in layer3.c in Underbit MAD libmad 0.15.1b, if NDEBUG is omitted,...

The mad_layer_III function in layer3.c in Underbit MAD libmad 0.15.1b, if NDEBUG is omitted, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted audio file.

Record
GHSA-qpg8-8vx5-pf3q
CVSS 3.0
4.7 MediumCVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-617
Updated
2026-11-02
OSVALPINE-CVE-2017-8372 4.7

The mad_layer_III function in layer3.c in Underbit MAD libmad 0.15.1b, if NDEBUG is omitted, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted audio file.

Record
ALPINE-CVE-2017-8372
CVSS 3.0
4.7 MediumCVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 4.7

The mad_layer_III function in layer3.c in Underbit MAD libmad 0.15.1b, if NDEBUG is omitted, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted audio file.

Record
CVE-2017-8372
CVSS 3.0
4.7 MediumCVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2017-8372 4.7

The mad_layer_III function in layer3.c in Underbit MAD libmad 0.15.1b, if NDEBUG is omitted, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted audio file.

Record
DEBIAN-CVE-2017-8372
CVSS 3.0
4.7 MediumCVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2017-8372 4.7

The mad_layer_III function in layer3.c in Underbit MAD libmad 0.15.1b, if NDEBUG is omitted, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted audio file.

Record
UBUNTU-CVE-2017-8372
CVSS 3.0
4.7 MediumCVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVSUSE-SU-2022:3782-1 No score

Security update for libmad

This update for libmad fixes the following issues:

  • CVE-2017-8373: Fixed heap-based buffer overflow in mad_layer_III (bsc#1036968).
  • CVE-2017-8372: Fixed assertion failure in layer3.c (bsc#1036969).
Record
SUSE-SU-2022:3782-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libmad
Alpine:v3.10
 before 0.15.1b-r9
0.15.1b-r9
libmad
Alpine:v3.11
 before 0.15.1b-r9
0.15.1b-r9
libmad
Alpine:v3.7
 before 0.15.1b-r8
0.15.1b-r8
libmad
Alpine:v3.8
 before 0.15.1b-r9
0.15.1b-r9
libmad
Alpine:v3.9
 before 0.15.1b-r9
0.15.1b-r9
libmad
Debian:12
 before 0.15.1b-9
0.15.1b-9
libmad
Debian:13
 before 0.15.1b-9
0.15.1b-9
libmad
Debian:14
 before 0.15.1b-9
0.15.1b-9
libmad
Debian:7
 before 0.15.1b-7+deb7u1, plus listed versions
0.15.1b-7
0.15.1b-7+deb7u1
libmad
Debian:8
 before 0.15.1b-8+deb8u1, plus listed versions
0.15.1b-8
0.15.1b-8+deb8u1
Show 27 moreShow less
Affected packages
PackageAffectedFixed
libmad
Debian:9
 before 0.15.1b-8+deb9u1, plus listed versions
0.15.1b-8
0.15.1b-8+deb9u1
libmad
SUSE:Linux Enterprise Module for Desktop Applications 15 SP3
 before 0.15.1b-150000.5.3.1
0.15.1b-150000.5.3.1
libmad
SUSE:Linux Enterprise Module for Desktop Applications 15 SP4
 before 0.15.1b-150000.5.3.1
0.15.1b-150000.5.3.1
libmad
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
 before 0.15.1b-150000.5.3.1
0.15.1b-150000.5.3.1
libmad
SUSE:Linux Enterprise High Performance Computing 15-LTSS
 before 0.15.1b-150000.5.3.1
0.15.1b-150000.5.3.1
libmad
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
 before 0.15.1b-150000.5.3.1
0.15.1b-150000.5.3.1
libmad
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
 before 0.15.1b-150000.5.3.1
0.15.1b-150000.5.3.1
libmad
SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS
 before 0.15.1b-150000.5.3.1
0.15.1b-150000.5.3.1
libmad
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
 before 0.15.1b-150000.5.3.1
0.15.1b-150000.5.3.1
libmad
SUSE:Linux Enterprise Server 15-LTSS
 before 0.15.1b-150000.5.3.1
0.15.1b-150000.5.3.1
libmad
SUSE:Linux Enterprise Server 15 SP1-BCL
 before 0.15.1b-150000.5.3.1
0.15.1b-150000.5.3.1
libmad
SUSE:Linux Enterprise Server 15 SP1-LTSS
 before 0.15.1b-150000.5.3.1
0.15.1b-150000.5.3.1
libmad
SUSE:Linux Enterprise Server 15 SP2-BCL
 before 0.15.1b-150000.5.3.1
0.15.1b-150000.5.3.1
libmad
SUSE:Linux Enterprise Server 15 SP2-LTSS
 before 0.15.1b-150000.5.3.1
0.15.1b-150000.5.3.1
libmad
SUSE:Linux Enterprise Server for SAP Applications 15
 before 0.15.1b-150000.5.3.1
0.15.1b-150000.5.3.1
libmad
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
 before 0.15.1b-150000.5.3.1
0.15.1b-150000.5.3.1
libmad
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
 before 0.15.1b-150000.5.3.1
0.15.1b-150000.5.3.1
libmad
SUSE:Manager Proxy 4.1
 before 0.15.1b-150000.5.3.1
0.15.1b-150000.5.3.1
libmad
SUSE:Manager Retail Branch Server 4.1
 before 0.15.1b-150000.5.3.1
0.15.1b-150000.5.3.1
libmad
SUSE:Manager Server 4.1
 before 0.15.1b-150000.5.3.1
0.15.1b-150000.5.3.1
libmad
SUSE:Enterprise Storage 6
 before 0.15.1b-150000.5.3.1
0.15.1b-150000.5.3.1
libmad
SUSE:Enterprise Storage 7
 before 0.15.1b-150000.5.3.1
0.15.1b-150000.5.3.1
libmad
openSUSE:Leap 15.3
 before 0.15.1b-150000.5.3.1
0.15.1b-150000.5.3.1
libmad
openSUSE:Leap 15.4
 before 0.15.1b-150000.5.3.1
0.15.1b-150000.5.3.1
libmad
Ubuntu:14.04:LTS
 before 0.15.1b-9ubuntu14.04.1, plus listed versions
0.15.1b-7ubuntu20.15.1b-8ubuntu1
0.15.1b-9ubuntu14.04.1
libmad
Ubuntu:16.04:LTS
 before 0.15.1b-9ubuntu16.04.1, plus listed versions
0.15.1b-8ubuntu1
0.15.1b-9ubuntu16.04.1
libmad
Ubuntu:18.04:LTS
 before 0.15.1b-9ubuntu18.04.1, plus listed versions
0.15.1b-8ubuntu1
0.15.1b-9ubuntu18.04.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-8372 is a medium vulnerability (CVSS 4.7) in Underbit Mad Libmad, published May 1, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.07%, the 81st percentile. Fixed in libmad 0.15.1b-r9.

References

Show 8 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open