CVE-2017-8372
The mad_layer_III function in layer3.c in Underbit MAD libmad 0.15.1b, if NDEBUG is omitted,...
The mad_layer_III function in layer3.c in Underbit MAD libmad 0.15.1b, if NDEBUG is omitted, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted audio file.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The mad_layer_III function in layer3.c in Underbit MAD libmad 0.15.1b, if NDEBUG is omitted, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted audio file.
- Record
CVE-2017-8372- CVSS 3.0
- 4.7 Medium
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 2.6 Low
AV:N/AC:H/Au:N/C:N/I:N/A:P - Weakness
- CWE-617
- Updated
- 2026-11-02
CVE List No score
The mad_layer_III function in layer3.c in Underbit MAD libmad 0.15.1b, if NDEBUG is omitted, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted audio file.
- Record
CVE-2017-8372- Updated
- 2026-11-02
EUVDEUVD-2017-17331 No score
The mad_layer_III function in layer3.c in Underbit MAD libmad 0.15.1b, if NDEBUG is omitted, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted audio file.
- Record
EUVD-2017-17331- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qpg8-8vx5-pf3q
The mad_layer_III function in layer3.c in Underbit MAD libmad 0.15.1b, if NDEBUG is omitted,...
The mad_layer_III function in layer3.c in Underbit MAD libmad 0.15.1b, if NDEBUG is omitted, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted audio file.
- Record
GHSA-qpg8-8vx5-pf3q- CVSS 3.0
- 4.7 Medium
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-617
- Updated
- 2026-11-02
OSVALPINE-CVE-2017-8372
The mad_layer_III function in layer3.c in Underbit MAD libmad 0.15.1b, if NDEBUG is omitted, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted audio file.
- Record
ALPINE-CVE-2017-8372- CVSS 3.0
- 4.7 Medium
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
The mad_layer_III function in layer3.c in Underbit MAD libmad 0.15.1b, if NDEBUG is omitted, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted audio file.
- Record
CVE-2017-8372- CVSS 3.0
- 4.7 Medium
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-8372
The mad_layer_III function in layer3.c in Underbit MAD libmad 0.15.1b, if NDEBUG is omitted, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted audio file.
- Record
DEBIAN-CVE-2017-8372- CVSS 3.0
- 4.7 Medium
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-8372
The mad_layer_III function in layer3.c in Underbit MAD libmad 0.15.1b, if NDEBUG is omitted, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted audio file.
- Record
UBUNTU-CVE-2017-8372- CVSS 3.0
- 4.7 Medium
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVSUSE-SU-2022:3782-1 No score
Security update for libmad
This update for libmad fixes the following issues:
- CVE-2017-8373: Fixed heap-based buffer overflow in mad_layer_III (bsc#1036968).
- CVE-2017-8372: Fixed assertion failure in layer3.c (bsc#1036969).
- Record
SUSE-SU-2022:3782-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libmadAlpine:v3.10 |
before 0.15.1b-r9 | 0.15.1b-r9 |
libmadAlpine:v3.11 |
before 0.15.1b-r9 | 0.15.1b-r9 |
libmadAlpine:v3.7 |
before 0.15.1b-r8 | 0.15.1b-r8 |
libmadAlpine:v3.8 |
before 0.15.1b-r9 | 0.15.1b-r9 |
libmadAlpine:v3.9 |
before 0.15.1b-r9 | 0.15.1b-r9 |
libmadDebian:12 |
before 0.15.1b-9 | 0.15.1b-9 |
libmadDebian:13 |
before 0.15.1b-9 | 0.15.1b-9 |
libmadDebian:14 |
before 0.15.1b-9 | 0.15.1b-9 |
libmadDebian:7 From an advisory covering 3 CVEs |
before 0.15.1b-7+deb7u1, plus listed versions 0.15.1b-7 |
0.15.1b-7+deb7u1 |
libmadDebian:8 From an advisory covering 3 CVEs |
before 0.15.1b-8+deb8u1, plus listed versions 0.15.1b-8 |
0.15.1b-8+deb8u1 |
Show 27 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libmadDebian:9 From an advisory covering 3 CVEs |
before 0.15.1b-8+deb9u1, plus listed versions 0.15.1b-8 |
0.15.1b-8+deb9u1 |
libmadSUSE:Linux Enterprise Module for Desktop Applications 15 SP3 From an advisory covering 2 CVEs |
before 0.15.1b-150000.5.3.1 | 0.15.1b-150000.5.3.1 |
libmadSUSE:Linux Enterprise Module for Desktop Applications 15 SP4 From an advisory covering 2 CVEs |
before 0.15.1b-150000.5.3.1 | 0.15.1b-150000.5.3.1 |
libmadSUSE:Linux Enterprise High Performance Computing 15-ESPOS From an advisory covering 2 CVEs |
before 0.15.1b-150000.5.3.1 | 0.15.1b-150000.5.3.1 |
libmadSUSE:Linux Enterprise High Performance Computing 15-LTSS From an advisory covering 2 CVEs |
before 0.15.1b-150000.5.3.1 | 0.15.1b-150000.5.3.1 |
libmadSUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS From an advisory covering 2 CVEs |
before 0.15.1b-150000.5.3.1 | 0.15.1b-150000.5.3.1 |
libmadSUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS From an advisory covering 2 CVEs |
before 0.15.1b-150000.5.3.1 | 0.15.1b-150000.5.3.1 |
libmadSUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS From an advisory covering 2 CVEs |
before 0.15.1b-150000.5.3.1 | 0.15.1b-150000.5.3.1 |
libmadSUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS From an advisory covering 2 CVEs |
before 0.15.1b-150000.5.3.1 | 0.15.1b-150000.5.3.1 |
libmadSUSE:Linux Enterprise Server 15-LTSS From an advisory covering 2 CVEs |
before 0.15.1b-150000.5.3.1 | 0.15.1b-150000.5.3.1 |
libmadSUSE:Linux Enterprise Server 15 SP1-BCL From an advisory covering 2 CVEs |
before 0.15.1b-150000.5.3.1 | 0.15.1b-150000.5.3.1 |
libmadSUSE:Linux Enterprise Server 15 SP1-LTSS From an advisory covering 2 CVEs |
before 0.15.1b-150000.5.3.1 | 0.15.1b-150000.5.3.1 |
libmadSUSE:Linux Enterprise Server 15 SP2-BCL From an advisory covering 2 CVEs |
before 0.15.1b-150000.5.3.1 | 0.15.1b-150000.5.3.1 |
libmadSUSE:Linux Enterprise Server 15 SP2-LTSS From an advisory covering 2 CVEs |
before 0.15.1b-150000.5.3.1 | 0.15.1b-150000.5.3.1 |
libmadSUSE:Linux Enterprise Server for SAP Applications 15 From an advisory covering 2 CVEs |
before 0.15.1b-150000.5.3.1 | 0.15.1b-150000.5.3.1 |
libmadSUSE:Linux Enterprise Server for SAP Applications 15 SP1 From an advisory covering 2 CVEs |
before 0.15.1b-150000.5.3.1 | 0.15.1b-150000.5.3.1 |
libmadSUSE:Linux Enterprise Server for SAP Applications 15 SP2 From an advisory covering 2 CVEs |
before 0.15.1b-150000.5.3.1 | 0.15.1b-150000.5.3.1 |
libmadSUSE:Manager Proxy 4.1 From an advisory covering 2 CVEs |
before 0.15.1b-150000.5.3.1 | 0.15.1b-150000.5.3.1 |
libmadSUSE:Manager Retail Branch Server 4.1 From an advisory covering 2 CVEs |
before 0.15.1b-150000.5.3.1 | 0.15.1b-150000.5.3.1 |
libmadSUSE:Manager Server 4.1 From an advisory covering 2 CVEs |
before 0.15.1b-150000.5.3.1 | 0.15.1b-150000.5.3.1 |
libmadSUSE:Enterprise Storage 6 From an advisory covering 2 CVEs |
before 0.15.1b-150000.5.3.1 | 0.15.1b-150000.5.3.1 |
libmadSUSE:Enterprise Storage 7 From an advisory covering 2 CVEs |
before 0.15.1b-150000.5.3.1 | 0.15.1b-150000.5.3.1 |
libmadopenSUSE:Leap 15.3 From an advisory covering 2 CVEs |
before 0.15.1b-150000.5.3.1 | 0.15.1b-150000.5.3.1 |
libmadopenSUSE:Leap 15.4 From an advisory covering 2 CVEs |
before 0.15.1b-150000.5.3.1 | 0.15.1b-150000.5.3.1 |
libmadUbuntu:14.04:LTS |
before 0.15.1b-9ubuntu14.04.1, plus listed versions 0.15.1b-7ubuntu20.15.1b-8ubuntu1 |
0.15.1b-9ubuntu14.04.1 |
libmadUbuntu:16.04:LTS |
before 0.15.1b-9ubuntu16.04.1, plus listed versions 0.15.1b-8ubuntu1 |
0.15.1b-9ubuntu16.04.1 |
libmadUbuntu:18.04:LTS |
before 0.15.1b-9ubuntu18.04.1, plus listed versions 0.15.1b-8ubuntu1 |
0.15.1b-9ubuntu18.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-8372 is a medium vulnerability (CVSS 4.7) in Underbit Mad Libmad, published May 1, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.07%, the 81st percentile. Fixed in libmad 0.15.1b-r9.
References
blogs.gentoo.org/ago/2017/04/30/libmad-assertion-failure-in-layer3-c
debian.org/security/2018/dsa-4192
lists.debian.org/debian-lts-announce/2018/05/msg00011.html
nvd.nist.gov/vuln/detail/CVE-2017-8372
github.com/advisories/GHSA-qpg8-8vx5-pf3q
security.alpinelinux.org/vuln/CVE-2017-8372