{"id":"CVE-2023-43361","aliases":["ALPINE-CVE-2023-43361","ALSA-2024:3095","AZL-31037","AZL-37055","CLSA-2024-1718896000","CLSA-2024-1718898745","DEBIAN-CVE-2023-43361","EUVD-2023-47778","GHSA-pg6h-8jmj-9wx8","MGASA-2023-0316","OESA-2024-2326","RHSA-2024:3095","RLSA-2024:3095","SUSE-SU-2023:4218-1","SUSE-SU-2023:4251-1","UBUNTU-CVE-2023-43361","openSUSE-SU-2024:13349-1"],"status":"published","title":"Buffer Overflow vulnerability in Vorbis-tools v.1.4.2 allows a local attacker to execute...","description":"Buffer Overflow vulnerability in Vorbis-tools v.1.4.2 allows a local attacker to execute arbitrary code and cause a denial of service during the conversion of wav files to ogg files.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00441,"percentile":0.38731,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2023-10-02T00:00:00Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Alpine:v3.18","package":"vorbis-tools","fixed_in":["9.54-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"vorbis-tools","fixed_in":["9.54-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"vorbis-tools","fixed_in":["9.54-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"vorbis-tools","fixed_in":["9.54-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"vorbis-tools","fixed_in":["9.54-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"vorbis-tools","fixed_in":["9.54-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"vorbis-tools","fixed_in":["9.54-r1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"vorbis-tools","fixed_in":["1:1.4.0-29.el8"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"vorbis-tools","fixed_in":["1:1.4.0-28.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"vorbis-tools","fixed_in":["1:1.4.0-28.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"vorbis-tools","fixed_in":["1.4.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"vorbis-tools","fixed_in":["1.4.3-1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"vorbis-tools","fixed_in":["1.4.0-15.1.mga8"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"vorbis-tools","fixed_in":["1.4.2-3.1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"vorbis-tools","fixed_in":["1.4.2-4.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"vorbis-tools","fixed_in":["1.4.2-4.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"vorbis-tools","fixed_in":["1.4.2-4.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"vorbis-tools","fixed_in":["1.4.2-4.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"vorbis-tools","fixed_in":["1.4.0-33.oe2003sp4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"vorbis-tools","fixed_in":["1:1.4.0-29.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"vorbis-tools-debuginfo","fixed_in":["1:1.4.0-29.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"vorbis-tools-debugsource","fixed_in":["1:1.4.0-29.el8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"vorbis-tools","fixed_in":["1:1.4.0-29.el8"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"vorbis-tools","fixed_in":["1.4.0-27.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"vorbis-tools","fixed_in":["1.4.0-27.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP4","package":"vorbis-tools","fixed_in":["1.4.0-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP5","package":"vorbis-tools","fixed_in":["1.4.0-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"vorbis-tools","fixed_in":["1.4.0-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"vorbis-tools","fixed_in":["1.4.0-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"vorbis-tools","fixed_in":["1.4.0-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"vorbis-tools","fixed_in":["1.4.0-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"vorbis-tools","fixed_in":["1.4.0-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"vorbis-tools","fixed_in":["1.4.0-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"vorbis-tools","fixed_in":["1.4.0-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"vorbis-tools","fixed_in":["1.4.0-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"vorbis-tools","fixed_in":["1.4.0-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"vorbis-tools","fixed_in":["1.4.0-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"vorbis-tools","fixed_in":["1.4.0-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"vorbis-tools","fixed_in":["1.4.0-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"vorbis-tools","fixed_in":["1.4.0-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"vorbis-tools","fixed_in":["1.4.2-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.18","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54-r1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.0-29.el8"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.4.2-6"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.4.2-6"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.0-28.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.0-28.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.2-1","1.4.2-2","1.4.3-1"]},{"source":"osv","ecosystem":"Debian:13","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3-1"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-15.1.mga8"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-3.1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-4.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-4.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-4.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-4.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-33.oe2003sp4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.0-29.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"vorbis-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.0-29.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"vorbis-tools-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.0-29.el8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.0-29.el8"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-27.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-27.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP4","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP5","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.0-6ubuntu1","1.4.0-7ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.0-10","1.4.0-10.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.0-11"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.0-11","1.4.2-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.2-1build2","1.4.2-1build4","1.4.2-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.2-2build1","1.4.3-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.3-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.3-1","1.4.3-1build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"vorbis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-2.1"}]}]}],"products":[{"vendor":"xiph","product":"vorbis-tools"}],"references":[{"url":"https://github.com/xiph/vorbis-tools/issues/41","tags":["x_transferred","Exploit","Issue Tracking","report"]},{"url":"https://github.com/xiph/vorbis-tools","tags":["x_transferred","Product","package","report"]},{"url":"https://github.com/xiph/vorbis","tags":["x_transferred","Not Applicable","package","report"]},{"url":"https://xiph.org/vorbis/","tags":["x_transferred","Vendor Advisory","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GJKTWQXOZDMCXVEFCQZVH3F3FQYMNYLI/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T47YXGRUCUKN7WEOHUEIUNJ2KZ2C2IDN/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GJKTWQXOZDMCXVEFCQZVH3F3FQYMNYLI/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T47YXGRUCUKN7WEOHUEIUNJ2KZ2C2IDN/","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-43361","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GJKTWQXOZDMCXVEFCQZVH3F3FQYMNYLI"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T47YXGRUCUKN7WEOHUEIUNJ2KZ2C2IDN"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GJKTWQXOZDMCXVEFCQZVH3F3FQYMNYLI"},{"url":"https://xiph.org/vorbis"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T47YXGRUCUKN7WEOHUEIUNJ2KZ2C2IDN"},{"url":"https://github.com/advisories/GHSA-pg6h-8jmj-9wx8"},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-43361","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:3095","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-43361","tags":["report"]},{"url":"https://bugzilla.redhat.com/2242151","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-3095.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.5-els/CLSA-2024-1718896000.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.4-els/CLSA-2024-1718898745.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/43xxx/CVE-2023-43361.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-43361","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0316.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32479","tags":["report"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2326","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.10_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2242151","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3095.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-43361","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2024:3095","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234218-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1215942","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-43361","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234251-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-43361","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-43361","description":"Buffer Overflow vulnerability in Vorbis-tools v.1.4.2 allows a local attacker to execute arbitrary code and cause a denial of service during the conversion of wav files to ogg files.","status":"published","published":"2023-10-02T00:00:00Z","modified":"2025-11-04T22:04:59.092Z","updated_at":"2026-11-02T14:35:14.633899Z"}],"euvd":[{"id":"EUVD-2023-47778","description":"Buffer Overflow vulnerability in Vorbis-tools v.1.4.2 allows a local attacker to execute arbitrary code and cause a denial of service during the conversion of wav files to ogg files.","status":"published","published":"2023-10-02T00:00:00Z","modified":"2025-11-04T22:04:59Z","updated_at":"2026-11-02T19:49:20.707326Z"}],"ghsa":[{"id":"GHSA-pg6h-8jmj-9wx8","title":"Buffer Overflow vulnerability in Vorbis-tools v.1.4.2 allows a local attacker to execute...","description":"Buffer Overflow vulnerability in Vorbis-tools v.1.4.2 allows a local attacker to execute arbitrary code and cause a denial of service during the conversion of wav files to ogg files.","status":"published","published":"2023-10-02T21:30:17Z","modified":"2025-11-05T00:31:12Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:04:38.82847Z"}],"nvd":[{"id":"CVE-2023-43361","description":"Buffer Overflow vulnerability in Vorbis-tools v.1.4.2 allows a local attacker to execute arbitrary code and cause a denial of service during the conversion of wav files to ogg files.","status":"published","published":"2023-10-02T21:15:34.52Z","modified":"2026-06-17T06:25:29.9Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:08:35.022405Z"}],"osv":[{"id":"ALPINE-CVE-2023-43361","description":"Buffer Overflow vulnerability in Vorbis-tools v.1.4.2 allows a local attacker to execute arbitrary code and cause a denial of service during the conversion of wav files to ogg files.","status":"published","published":"2023-10-02T21:15:34.52Z","modified":"2026-11-03T06:32:59.355354289Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:16:09.603409Z"},{"id":"AZL-31037","title":"CVE-2023-43361 affecting package vorbis-tools 1.4.2-6","description":"Buffer Overflow vulnerability in Vorbis-tools v.1.4.2 allows a local attacker to execute arbitrary code and cause a denial of service during the conversion of wav files to ogg files.","status":"published","published":"2023-10-02T21:15:34Z","modified":"2026-04-21T04:26:04.371806Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:03.46006Z"},{"id":"AZL-37055","title":"CVE-2023-43361 affecting package vorbis-tools 1.4.2-6","description":"Buffer Overflow vulnerability in Vorbis-tools v.1.4.2 allows a local attacker to execute arbitrary code and cause a denial of service during the conversion of wav files to ogg files.","status":"published","published":"2023-10-02T21:15:34Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:19.751978Z"},{"id":"DEBIAN-CVE-2023-43361","description":"Buffer Overflow vulnerability in Vorbis-tools v.1.4.2 allows a local attacker to execute arbitrary code and cause a denial of service during the conversion of wav files to ogg files.","status":"published","published":"2023-10-02T21:15:34.52Z","modified":"2026-10-26T18:03:06.936157091Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"OESA-2024-2326","title":"vorbis-tools security update","description":"Ogg Vorbis is a fully open, non-proprietary, patent-and-royalty-free, general-purpose compressed audio format for mid to high quality (8kHz-48.0kHz, 16+ bit, polyphonic) audio and music at fixed and variable bitrates from 16 to 128 kbps/channel. This places Vorbis in the same competitive class as audio representations such as MPEG-4 (AAC), and similar to, but higher performance than MPEG-1/2 audio layer 3, MPEG-4 audio (TwinVQ), WMA and PAC.\r\n\r\nSecurity Fix(es):\r\n\r\nBuffer Overflow vulnerability in Vorbis-tools v.1.4.2 allows a local attacker to execute arbitrary code and cause a denial of service during the conversion of wav files to ogg files.(CVE-2023-43361)","status":"published","published":"2024-11-01T11:07:48Z","modified":"2026-08-18T01:17:36.383846643Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"RHSA-2024:3095","title":"Red Hat Security Advisory: vorbis-tools security update","status":"published","published":"2024-09-16T17:06:07Z","modified":"2026-03-18T11:35:09.277275Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RLSA-2024:3095","title":"Moderate: vorbis-tools security update","description":"The vorbis-tools packages provide an encoder, a decoder, a playback tool, and a comment editor for Ogg Vorbis. Ogg Vorbis is a fully open, non-proprietary, patent- and royalty-free, general-purpose compressed audio format.\n\nSecurity Fix(es):\n\n* vorbis-tools: Buffer Overflow vulnerability (CVE-2023-43361)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.10 Release Notes linked from the References section.","status":"published","published":"2025-05-07T19:11:47.341314Z","modified":"2025-05-07T20:08:44.473128Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"UBUNTU-CVE-2023-43361","description":"Buffer Overflow vulnerability in Vorbis-tools v.1.4.2 allows a local attacker to execute arbitrary code and cause a denial of service during the conversion of wav files to ogg files.","status":"published","published":"2023-10-02T21:15:00Z","modified":"2026-10-17T12:56:26.428323831Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"ALSA-2024:3095","title":"Moderate: vorbis-tools security update","description":"The vorbis-tools packages provide an encoder, a decoder, a playback tool, and a comment editor for Ogg Vorbis. Ogg Vorbis is a fully open, non-proprietary, patent- and royalty-free, general-purpose compressed audio format.\n\nSecurity Fix(es):\n\n* vorbis-tools: Buffer Overflow vulnerability (CVE-2023-43361)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2024-05-22T00:00:00Z","modified":"2026-10-29T11:02:26.311028893Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"CLSA-2024-1718896000","title":"vorbis-tools: Fix of CVE-2023-43361","description":"- CVE-2023-43361: fix out-of-buffer operations","status":"published","published":"2024-06-20T15:06:43Z","modified":"2026-06-01T00:33:22.572625889Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"CLSA-2024-1718898745","title":"vorbis-tools: Fix of CVE-2023-43361","description":"- CVE-2023-43361: fix out-of-buffer operations","status":"published","published":"2024-06-20T15:52:27Z","modified":"2026-06-01T00:33:20.283131486Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"CVE-2023-43361","description":"Buffer Overflow vulnerability in Vorbis-tools v.1.4.2 allows a local attacker to execute arbitrary code and cause a denial of service during the conversion of wav files to ogg files.","status":"published","published":"2023-10-02T00:00:00Z","modified":"2026-10-28T02:30:54.145438431Z","updated_at":"2026-11-02T15:44:33.792101Z"},{"id":"MGASA-2023-0316","title":"Updated vorbis-tools packages fix a security vulnerability","description":"The upstream patch to fix CVE-2023-43361 was added\n","status":"published","published":"2023-11-12T00:44:53Z","modified":"2026-04-16T04:43:14.172806722Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:13349-1","title":"vorbis-tools-1.4.2-2.1 on GA media","description":"These are all security issues fixed in the vorbis-tools-1.4.2-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:37:01.903317Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2023:4218-1","title":"Security update for vorbis-tools","description":"This update for vorbis-tools fixes the following issues:\n\n- CVE-2023-43361: Fixed a buffer overflow vulnerability during the conversion of wav files to ogg files. (bsc#1215942)\n","status":"published","published":"2023-10-26T14:55:07Z","modified":"2025-05-02T04:35:28.92299Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4251-1","title":"Security update for vorbis-tools","description":"This update for vorbis-tools fixes the following issues:\n\n- CVE-2023-43361: Fixed a buffer overflow vulnerability during the conversion of wav files to ogg files. (bsc#1215942)\n","status":"published","published":"2023-10-30T08:51:47Z","modified":"2026-02-04T02:32:28.613511Z","updated_at":"2026-11-02T15:53:53.865042Z"}]}}