CVE-2017-8374
The mad_bit_skip function in bit.c in Underbit MAD libmad 0.15.1b allows remote attackers to...
The mad_bit_skip function in bit.c in Underbit MAD libmad 0.15.1b allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted audio file.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The mad_bit_skip function in bit.c in Underbit MAD libmad 0.15.1b allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted audio file.
- Record
CVE-2017-8374- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List No score
The mad_bit_skip function in bit.c in Underbit MAD libmad 0.15.1b allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted audio file.
- Record
CVE-2017-8374- Updated
- 2026-11-02
EUVDEUVD-2017-17333 No score
The mad_bit_skip function in bit.c in Underbit MAD libmad 0.15.1b allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted audio file.
- Record
EUVD-2017-17333- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-c54g-f6hp-4w5x
The mad_bit_skip function in bit.c in Underbit MAD libmad 0.15.1b allows remote attackers to...
The mad_bit_skip function in bit.c in Underbit MAD libmad 0.15.1b allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted audio file.
- Record
GHSA-c54g-f6hp-4w5x- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVALPINE-CVE-2017-8374
The mad_bit_skip function in bit.c in Underbit MAD libmad 0.15.1b allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted audio file.
- Record
ALPINE-CVE-2017-8374- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
The mad_bit_skip function in bit.c in Underbit MAD libmad 0.15.1b allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted audio file.
- Record
CVE-2017-8374- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVDEBIAN-CVE-2017-8374
The mad_bit_skip function in bit.c in Underbit MAD libmad 0.15.1b allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted audio file.
- Record
DEBIAN-CVE-2017-8374- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-8374
The mad_bit_skip function in bit.c in Underbit MAD libmad 0.15.1b allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted audio file.
- Record
UBUNTU-CVE-2017-8374- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2018-0019 No score
Updated mad packages fix security vulnerability
The mad_layer_III function in layer3.c in Underbit MAD libmad 0.15.1b allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted audio file (CVE-2017-8373).
The mad_bit_skip function in bit.c in Underbit MAD libmad 0.15.1b allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted audio file (CVE-2017-8374).
- Record
MGASA-2018-0019- Updated
- 2026-11-02
OSVopenSUSE-SU-2018:0527-1 No score
Security update for libmad
This update for libmad fixes the following issues:
- CVE-2017-8374: Fixed a heap-based buffer overflow (read) in mad_bit_skip (boo#1036967)
- Record
openSUSE-SU-2018:0527-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2018:0528-1 No score
Security update for libmad
This update for libmad fixes the following issues:
- CVE-2017-8374: Fixed a heap-based buffer overflow (read) in mad_bit_skip (boo#1036967)
- Record
openSUSE-SU-2018:0528-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10954-1 No score
libmad-devel-0.15.1b-3.15 on GA media
These are all security issues fixed in the libmad-devel-0.15.1b-3.15 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10954-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libmadAlpine:v3.10 |
before 0.15.1b-r9 | 0.15.1b-r9 |
libmadAlpine:v3.11 |
before 0.15.1b-r9 | 0.15.1b-r9 |
libmadAlpine:v3.7 |
before 0.15.1b-r8 | 0.15.1b-r8 |
libmadAlpine:v3.8 |
before 0.15.1b-r9 | 0.15.1b-r9 |
libmadAlpine:v3.9 |
before 0.15.1b-r9 | 0.15.1b-r9 |
libmadDebian:12 |
before 0.15.1b-9 | 0.15.1b-9 |
libmadDebian:13 |
before 0.15.1b-9 | 0.15.1b-9 |
libmadDebian:14 |
before 0.15.1b-9 | 0.15.1b-9 |
libmadDebian:7 |
before 0.15.1b-7+deb7u1, plus listed versions 0.15.1b-7 |
0.15.1b-7+deb7u1 |
libmadDebian:8 |
before 0.15.1b-8+deb8u1, plus listed versions 0.15.1b-8 |
0.15.1b-8+deb8u1 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libmadDebian:9 |
before 0.15.1b-8+deb9u1, plus listed versions 0.15.1b-8 |
0.15.1b-8+deb9u1 |
madMageia:5 |
before 0.15.1b-17.4.mga5 | 0.15.1b-17.4.mga5 |
madMageia:6 |
before 0.15.1b-22.1.mga6 | 0.15.1b-22.1.mga6 |
libmadUbuntu:14.04:LTS |
before 0.15.1b-9ubuntu14.04.1, plus listed versions 0.15.1b-7ubuntu20.15.1b-8ubuntu1 |
0.15.1b-9ubuntu14.04.1 |
libmadUbuntu:16.04:LTS |
before 0.15.1b-9ubuntu16.04.1, plus listed versions 0.15.1b-8ubuntu1 |
0.15.1b-9ubuntu16.04.1 |
libmadUbuntu:18.04:LTS |
before 0.15.1b-9ubuntu18.04.1, plus listed versions 0.15.1b-8ubuntu1 |
0.15.1b-9ubuntu18.04.1 |
libmadSUSE:Package Hub 12 SP1 |
before 0.15.1b-5.1 | 0.15.1b-5.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-8374 is a medium vulnerability (CVSS 5.5) in Underbit Mad Libmad, published May 1, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.23%, the 82nd percentile. Fixed in libmad 0.15.1b-r9.
References
blogs.gentoo.org/ago/2017/04/30/libmad-heap-based-buffer-overflow-in-mad_bit_skip-bit-c
debian.org/security/2018/dsa-4192
lists.debian.org/debian-lts-announce/2018/05/msg00011.html
nvd.nist.gov/vuln/detail/CVE-2017-8374
github.com/advisories/GHSA-c54g-f6hp-4w5x
security.alpinelinux.org/vuln/CVE-2017-8374
Show 10 moreShow less
security-tracker.debian.org/tracker/CVE-2017-8374
advisories.mageia.org/MGASA-2018-0019.html
bugs.mageia.org/show_bug.cgi?id=20773
openwall.com/lists/oss-security/2017/05/01/8
ubuntu.com/security/CVE-2017-8374
cve.org/CVERecord?id=CVE-2017-8374
bugzilla.suse.com/1036967
suse.com/security/cve/CVE-2017-8374