Every CVE Search/ Get API key

CVE-2008-1686

Array index vulnerability in Speex 1.1.12 and earlier, as used in libfishsound 0.9.0 and earlier,...

9.3 HighFix available

Array index vulnerability in Speex 1.1.12 and earlier, as used in libfishsound 0.9.0 and earlier, including Illiminable DirectShow Filters and Annodex Plugins for Firefox, xine-lib before 1.1.12, and many other products, allows remote attackers to execute arbitrary code via a header structure containing a negative offset, which is used to dereference a function pointer.

Exploit likelihood

6.49%Down 3.4 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 9.3

Array index vulnerability in Speex 1.1.12 and earlier, as used in libfishsound 0.9.0 and earlier, including Illiminable DirectShow Filters and Annodex Plugins for Firefox, xine-lib before 1.1.12, and many other products, allows remote attackers to execute arbitrary code via a header structure containing a negative offset, which is used to dereference a function pointer.

Record
CVE-2008-1686
CVSS 2.0
9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness
CWE-189
Updated
2026-11-02
CVE List No score

Array index vulnerability in Speex 1.1.12 and earlier, as used in libfishsound 0.9.0 and earlier, including Illiminable DirectShow Filters and Annodex Plugins for Firefox, xine-lib before 1.1.12, and many other products, allows remote attackers to execute arbitrary code via a header structure containing a negative offset, which is used to dereference a function pointer.

Record
CVE-2008-1686
Updated
2026-11-02
EUVDEUVD-2008-1687 No score

Array index vulnerability in Speex 1.1.12 and earlier, as used in libfishsound 0.9.0 and earlier, including Illiminable DirectShow Filters and Annodex Plugins for Firefox, xine-lib before 1.1.12, and many other products, allows remote attackers to execute arbitrary code via a header structure containing a negative offset, which is used to dereference a function pointer.

Record
EUVD-2008-1687
Updated
2026-11-03
GitHub AdvisoriesGHSA-8q5j-pq4c-9v79 No score

Array index vulnerability in Speex 1.1.12 and earlier, as used in libfishsound 0.9.0 and earlier,...

Array index vulnerability in Speex 1.1.12 and earlier, as used in libfishsound 0.9.0 and earlier, including Illiminable DirectShow Filters and Annodex Plugins for Firefox, xine-lib before 1.1.12, and many other products, allows remote attackers to execute arbitrary code via a header structure containing a negative offset, which is used to dereference a function pointer.

Record
GHSA-8q5j-pq4c-9v79
Updated
2026-11-02
OSV No score

Array index vulnerability in Speex 1.1.12 and earlier, as used in libfishsound 0.9.0 and earlier, including Illiminable DirectShow Filters and Annodex Plugins for Firefox, xine-lib before 1.1.12, and many other products, allows remote attackers to execute arbitrary code via a header structure containing a negative offset, which is used to dereference a function pointer.

Record
CVE-2008-1686
Updated
2026-11-02
OSVDEBIAN-CVE-2008-1686 No score

Array index vulnerability in Speex 1.1.12 and earlier, as used in libfishsound 0.9.0 and earlier, including Illiminable DirectShow Filters and Annodex Plugins for Firefox, xine-lib before 1.1.12, and many other products, allows remote attackers to execute arbitrary code via a header structure containing a negative offset, which is used to dereference a function pointer.

Record
DEBIAN-CVE-2008-1686
Updated
2026-11-02
OSVopenSUSE-SU-2024:10610-1 No score

libSDL_sound-1_0-1-1.0.3-94.20 on GA media

These are all security issues fixed in the libSDL_sound-1_0-1-1.0.3-94.20 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10610-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10829-1 No score

gstreamer-plugins-good-1.18.5-2.1 on GA media

These are all security issues fixed in the gstreamer-plugins-good-1.18.5-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10829-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11503-1 No score

vorbis-tools-1.4.2-1.6 on GA media

These are all security issues fixed in the vorbis-tools-1.4.2-1.6 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11503-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libfishsound
Debian:12
 before 0.7.0-2.2
0.7.0-2.2
libfishsound
Debian:13
 before 0.7.0-2.2
0.7.0-2.2
libfishsound
Debian:14
 before 0.7.0-2.2
0.7.0-2.2
speex
Debian:12
 before 1.2~beta2-1
1.2~beta2-1
speex
Debian:13
 before 1.2~beta2-1
1.2~beta2-1
speex
Debian:14
 before 1.2~beta2-1
1.2~beta2-1
libfishsound
Debian:4.0
 before 0.7.0-2etch1, plus listed versions
0.7.0-2
0.7.0-2etch1
speex
Debian:4.0
 before 1.1.12-3etch1, plus listed versions
1.1.12-3
1.1.12-3etch1
xine-lib
Debian:4.0
 before 1.1.2+dfsg-7, plus listed versions
1.1.2+dfsg-41.1.2+dfsg-51.1.2+dfsg-6
1.1.2+dfsg-7
libfishsound
Debian:5.0
 before 0.7.0-2.1+lenny1
0.7.0-2.1+lenny1
Show 24 moreShow less
Affected packages
PackageAffectedFixed
xine-lib
Debian:5.0
 before 1.1.10.1-2+lenny2
1.1.10.1-2+lenny2
speex
Debian:5.0
 before 1.1.12-3+lenny1
1.1.12-3+lenny1
speex
Red Hat:enterprise_linux:4::as
 before 0:1.0.4-4.el4_6.1
0:1.0.4-4.el4_6.1
speex-debuginfo
Red Hat:enterprise_linux:4::as
 before 0:1.0.4-4.el4_6.1
0:1.0.4-4.el4_6.1
speex-devel
Red Hat:enterprise_linux:4::as
 before 0:1.0.4-4.el4_6.1
0:1.0.4-4.el4_6.1
speex
Red Hat:enterprise_linux:4::desktop
 before 0:1.0.4-4.el4_6.1
0:1.0.4-4.el4_6.1
speex-debuginfo
Red Hat:enterprise_linux:4::desktop
 before 0:1.0.4-4.el4_6.1
0:1.0.4-4.el4_6.1
speex-devel
Red Hat:enterprise_linux:4::desktop
 before 0:1.0.4-4.el4_6.1
0:1.0.4-4.el4_6.1
speex
Red Hat:enterprise_linux:4::es
 before 0:1.0.4-4.el4_6.1
0:1.0.4-4.el4_6.1
speex-debuginfo
Red Hat:enterprise_linux:4::es
 before 0:1.0.4-4.el4_6.1
0:1.0.4-4.el4_6.1
speex-devel
Red Hat:enterprise_linux:4::es
 before 0:1.0.4-4.el4_6.1
0:1.0.4-4.el4_6.1
speex
Red Hat:enterprise_linux:4::ws
 before 0:1.0.4-4.el4_6.1
0:1.0.4-4.el4_6.1
speex-debuginfo
Red Hat:enterprise_linux:4::ws
 before 0:1.0.4-4.el4_6.1
0:1.0.4-4.el4_6.1
speex-devel
Red Hat:enterprise_linux:4::ws
 before 0:1.0.4-4.el4_6.1
0:1.0.4-4.el4_6.1
speex
Red Hat:enterprise_linux:5::client_workstation
 before 0:1.0.5-4.el5_1.1
0:1.0.5-4.el5_1.1
speex-debuginfo
Red Hat:enterprise_linux:5::client_workstation
 before 0:1.0.5-4.el5_1.1
0:1.0.5-4.el5_1.1
speex-devel
Red Hat:enterprise_linux:5::client_workstation
 before 0:1.0.5-4.el5_1.1
0:1.0.5-4.el5_1.1
speex
Red Hat:enterprise_linux:5::client
 before 0:1.0.5-4.el5_1.1
0:1.0.5-4.el5_1.1
speex-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:1.0.5-4.el5_1.1
0:1.0.5-4.el5_1.1
speex
Red Hat:enterprise_linux:5::server
 before 0:1.0.5-4.el5_1.1
0:1.0.5-4.el5_1.1
speex-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:1.0.5-4.el5_1.1
0:1.0.5-4.el5_1.1
speex-devel
Red Hat:enterprise_linux:5::server
 before 0:1.0.5-4.el5_1.1
0:1.0.5-4.el5_1.1
gstreamer-plugins-good
openSUSE:Tumbleweed
 before 1.18.5-2.1
1.18.5-2.1
vorbis-tools
openSUSE:Tumbleweed
 before 1.4.2-1.6
1.4.2-1.6

History

History
RecordedChangedSources
aliasesEUVD
aliases
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2008-1686 is a high vulnerability (CVSS 9.3) in Xine Xine-lib, published April 8, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.49%, the 93rd percentile. Fixed in libfishsound 0.7.0-2.2.

References

Show 63 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open