{"id":"CVE-2017-11550","aliases":["ALPINE-CVE-2017-11550","AZL-36951","AZL-7262","DEBIAN-CVE-2017-11550","EUVD-2017-3166","GHSA-qm72-g7qg-9h32","MGASA-2018-0223","SUSE-SU-2018:0715-1","SUSE-SU-2018:0722-1","UBUNTU-CVE-2017-11550","openSUSE-SU-2024:10948-1"],"status":"published","title":"The id3_ucs4_length function in ucs4.c in libid3tag 0.15.1b allows remote attackers to cause a...","description":"The id3_ucs4_length function in ucs4.c in libid3tag 0.15.1b allows remote attackers to cause a denial of service (NULL Pointer Dereference and application crash) via a crafted mp3 file.","severity":{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01465,"percentile":0.73821,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2017-07-31T13:00:00Z","modified":"2026-09-01T20:03:41Z","fixes":[{"ecosystem":"Alpine:v3.16","package":"libid3tag","fixed_in":["0.16.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"libid3tag","fixed_in":["0.16.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"libid3tag","fixed_in":["0.16.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"libid3tag","fixed_in":["0.16.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"libid3tag","fixed_in":["0.16.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"libid3tag","fixed_in":["0.16.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"libid3tag","fixed_in":["0.16.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"libid3tag","fixed_in":["0.16.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libid3tag","fixed_in":["0.16.2-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"libid3tag","fixed_in":["0.16.3-7"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libid3tag","fixed_in":["0.15.1b-9"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libid3tag","fixed_in":["0.15.1b-9"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libid3tag","fixed_in":["0.15.1b-9"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.16","package":"libid3tag","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"libid3tag","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"libid3tag","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"libid3tag","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"libid3tag","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"libid3tag","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"libid3tag","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"libid3tag","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libid3tag","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.2-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"libid3tag","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.3-7"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"libid3tag","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.15.1b-33"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libid3tag","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.1b-9"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libid3tag","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.1b-9"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libid3tag","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.1b-9"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"libid3tag","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.1b-16.2.mga5"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:6","package":"libid3tag","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.1b-17.2.mga6"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"libid3tag","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.1b-132.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"libid3tag","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.1b-184.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"libid3tag","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.1b-184.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"libid3tag","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.1b-184.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"libid3tag","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.1b-184.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP2","package":"libid3tag","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.1b-184.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP3","package":"libid3tag","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.1b-184.3.1"}]}],"bundled":4}],"products":[{"vendor":"libid3tag_project","product":"libid3tag"}],"references":[{"url":"http://seclists.org/fulldisclosure/2017/Jul/85","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-11550","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qm72-g7qg-9h32"},{"url":"https://security.alpinelinux.org/vuln/CVE-2017-11550","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-11550","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0223.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22802","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180715-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1081959","tags":["report"]},{"url":"https://bugzilla.suse.com/1081961","tags":["report"]},{"url":"https://bugzilla.suse.com/1081962","tags":["report"]},{"url":"https://bugzilla.suse.com/387731","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2004-2779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-2109","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11551","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180722-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-11550","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-11550","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2017-11550","description":"The id3_ucs4_length function in ucs4.c in libid3tag 0.15.1b allows remote attackers to cause a denial of service (NULL Pointer Dereference and application crash) via a crafted mp3 file.","status":"published","published":"2017-07-31T13:00:00Z","modified":"2024-08-05T18:12:40.35Z","updated_at":"2026-11-02T14:33:19.848632Z"}],"euvd":[{"id":"EUVD-2017-3166","description":"The id3_ucs4_length function in ucs4.c in libid3tag 0.15.1b allows remote attackers to cause a denial of service (NULL Pointer Dereference and application crash) via a crafted mp3 file.","status":"published","published":"2017-07-31T13:00:00Z","modified":"2024-08-05T18:12:40Z","updated_at":"2026-11-03T02:23:23.105133Z"}],"ghsa":[{"id":"GHSA-qm72-g7qg-9h32","title":"The id3_ucs4_length function in ucs4.c in libid3tag 0.15.1b allows remote attackers to cause a...","description":"The id3_ucs4_length function in ucs4.c in libid3tag 0.15.1b allows remote attackers to cause a denial of service (NULL Pointer Dereference and application crash) via a crafted mp3 file.","status":"published","published":"2022-05-17T02:20:36Z","modified":"2023-01-27T05:04:17Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:42:25.677567Z"}],"nvd":[{"id":"CVE-2017-11550","description":"The id3_ucs4_length function in ucs4.c in libid3tag 0.15.1b allows remote attackers to cause a denial of service (NULL Pointer Dereference and application crash) via a crafted mp3 file.","status":"published","published":"2017-07-31T13:29:01.503Z","modified":"2026-06-17T01:01:59.187Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:03:54.862898Z"}],"osv":[{"id":"ALPINE-CVE-2017-11550","description":"The id3_ucs4_length function in ucs4.c in libid3tag 0.15.1b allows remote attackers to cause a denial of service (NULL Pointer Dereference and application crash) via a crafted mp3 file.","status":"published","published":"2017-07-31T13:29:01.503Z","modified":"2026-06-15T18:18:06.73055552Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:46.716249Z"},{"id":"AZL-36951","title":"CVE-2017-11550 affecting package libid3tag for versions less than 0.16.3-7","description":"The id3_ucs4_length function in ucs4.c in libid3tag 0.15.1b allows remote attackers to cause a denial of service (NULL Pointer Dereference and application crash) via a crafted mp3 file.","status":"published","published":"2017-07-31T13:29:01Z","modified":"2026-04-21T04:33:23.691826Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:04.173658Z"},{"id":"AZL-7262","title":"CVE-2017-11550 affecting package libid3tag 0.15.1b-33","description":"The id3_ucs4_length function in ucs4.c in libid3tag 0.15.1b allows remote attackers to cause a denial of service (NULL Pointer Dereference and application crash) via a crafted mp3 file.","status":"published","published":"2017-07-31T13:29:01Z","modified":"2026-04-21T04:36:46.32323Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:09.201912Z"},{"id":"CVE-2017-11550","description":"The id3_ucs4_length function in ucs4.c in libid3tag 0.15.1b allows remote attackers to cause a denial of service (NULL Pointer Dereference and application crash) via a crafted mp3 file.","status":"published","published":"2017-07-31T13:29:01.503Z","modified":"2026-04-16T06:18:55.907240015Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:03.851821Z"},{"id":"DEBIAN-CVE-2017-11550","description":"The id3_ucs4_length function in ucs4.c in libid3tag 0.15.1b allows remote attackers to cause a denial of service (NULL Pointer Dereference and application crash) via a crafted mp3 file.","status":"published","published":"2017-07-31T13:29:01.503Z","modified":"2026-09-01T20:03:41.454912159Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:28.50097Z"},{"id":"UBUNTU-CVE-2017-11550","description":"The id3_ucs4_length function in ucs4.c in libid3tag 0.15.1b allows remote attackers to cause a denial of service (NULL Pointer Dereference and application crash) via a crafted mp3 file.","status":"withdrawn","published":"2017-07-31T13:29:00Z","modified":"2025-07-16T08:12:49.018771Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:13.729565Z"},{"id":"MGASA-2018-0223","title":"Updated libid3tag packages fix security vulnerabilities","description":"id3_utf16_deserialize() in utf16.c in libid3tag through 0.15.1b\nmisparses ID3v2 tags encoded in UTF-16 with an odd number of bytes,\ntriggering an endless loop allocating memory until an OOM condition is\nreached, leading to denial-of-service (DoS). (CVE-2004-2779)\n\nfield.c in the libid3tag 0.15.0b library allows context-dependent\nattackers to cause a denial of service (CPU consumption) via an\nID3_FIELD_TYPE_STRINGLIST field that ends in '\\0', which triggers an\ninfinite loop. (CVE-2008-2109)\n\nThe id3_ucs4_length function in ucs4.c in libid3tag 0.15.1b allows\nremote attackers to cause a denial of service (NULL Pointer Dereference\nand application crash) via a crafted mp3 file. (CVE-2017-11550)\n\nThe id3_field_parse function in field.c in libid3tag 0.15.1b allows\nremote attackers to cause a denial of service (OOM) via a crafted MP3\nfile. (CVE-2017-11551)\n","status":"published","published":"2018-05-09T18:33:09Z","modified":"2026-04-16T06:25:16.529489342Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"openSUSE-SU-2024:10948-1","title":"libid3tag-devel-0.15.1b-188.15 on GA media","description":"These are all security issues fixed in the libid3tag-devel-0.15.1b-188.15 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:24:48.838322Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2018:0715-1","title":"Security update for libid3tag","description":"This update for libid3tag fixes the following issues:\n\n- CVE-2004-2779 CVE-2017-11551: Fixed id3_utf16_deserialize() in utf16.c,\n  which previously misparsed ID3v2 tags encoded in UTF-16 with an odd\n  number of bytes, triggering an endless loop allocating memory until\n  OOM leading to DoS. (bsc#1081959 bsc#1081961)\n- CVE-2017-11550 CVE-2008-2109: Fixed the handling of unknown\n  encodings when parsing ID3 tags. (bsc#1081962 bsc#387731)\n","status":"published","published":"2018-03-16T15:31:57Z","modified":"2026-02-04T02:45:55.096172Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"SUSE-SU-2018:0722-1","title":"Security update for libid3tag","description":"This update for libid3tag fixes the following issues:\n\n- CVE-2004-2779 CVE-2017-11551: Fixed id3_utf16_deserialize() in utf16.c,\n  which previously misparsed ID3v2 tags encoded in UTF-16 with an odd\n  number of bytes, triggering an endless loop allocating memory until\n  OOM leading to DoS. (bsc#1081959 bsc#1081961)\n- CVE-2017-11550 CVE-2008-2109: Fixed the handling of unknown\n  encodings when parsing ID3 tags. (bsc#1081962 bsc#387731)\n","status":"published","published":"2018-03-16T15:32:29Z","modified":"2026-02-04T04:08:07.553291Z","updated_at":"2026-11-02T15:53:44.594517Z"}]}}