Xiph vulnerabilities

Products

• Vorbis-tools 6
• Speex 4
• Icecast 3
• Theora 2

Newest

• xiph speex Speex through 1.2.1 Out-of-Bounds Write via speex_bits_read_whole_bytes CVE-2026-116741 Fix available 8.3 HighOctober 26, 2026
• xiph theora, red hat enterprise linux 10, enterprise linux 6 +4 more +6 more Libtheora: libtheora: denial of service or information disclosure via malformed avi file processing CVE-2026-5673 Fix available 5.6 MediumApril 6, 2026
• xiph theora oc_huff_tree_unpack in huffdec.c in libtheora in Theora through 1.0 7180717 has an invalid... CVE-2024-56431 Public exploitFix availableDisputed 9.8 CriticalDecember 25, 2024
• xiph vorbis-tools Buffer Overflow vulnerability in Vorbis-tools v.1.4.2 allows a local attacker to execute... CVE-2023-43361 Fix available 7.8 HighOctober 2, 2023
• xiph opusfile, fedoraproject fedora +1 more A null pointer dereference issue was discovered in functions op_get_data and op_open1 in opusfile... CVE-2022-47021 Fix available 7.8 HighJanuary 20, 2023
• xiph speex A stack buffer overflow in speexenc.c of Speex v1.2 allows attackers to cause a denial of service... CVE-2020-23904 Disputed 5.5 MediumNovember 10, 2021
• xiph speex, fedoraproject fedora +1 more A Divide by Zero vulnerability in the function static int read_samples of Speex v1.2 allows... CVE-2020-23903 Fix available 5.5 MediumNovember 10, 2021
• xiph icecast, debian linux +1 more A buffer overflow was discovered in the URL-authentication backend of the Icecast before 2.4.4.... CVE-2018-18820 Public exploitFix available EPSS 48.9% 8.1 HighNovember 4, 2018
• xiph libao The _tokenize_matrix function in audio_out.c in Xiph.Org libao 1.2.0 allows remote attackers to... CVE-2017-11548 Public exploitFix available 5.5 MediumJuly 31, 2017
• xiph vorbis-tools The wav_open function in oggenc/audio.c in Xiph.Org vorbis-tools 1.4.0 allows remote attackers to... CVE-2017-11331 Public exploitFix available 5.5 MediumJuly 31, 2017
• xiph vorbis-tools Buffer overflow in the aiff_open function in oggenc/audio.c in vorbis-tools 1.4.0 and earlier... CVE-2015-6749 Fix available 4.3 MediumSeptember 8, 2015
• xiph icecast, debian linux, opensuse +2 more Icecast before 2.4.2, when a stream_auth handler is defined for URL authentication, allows remote... CVE-2015-3026 Fix available 5.0 MediumApril 29, 2015
• xiph vorbis-tools, opensuse +1 more oggenc/oggenc.c in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (out... CVE-2014-9640 Fix available 5.0 MediumJanuary 23, 2015
• xiph vorbis-tools, fedoraproject fedora, opensuse +2 more Integer overflow in oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of... CVE-2014-9639 Fix available 5.0 MediumJanuary 23, 2015
• xiph vorbis-tools, fedoraproject fedora, opensuse +2 more oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (divide-by-zero... CVE-2014-9638 Fix available 5.0 MediumJanuary 23, 2015
• xiph icecast icecast before 2.3.3 allows remote attackers to inject control characters such as newlines into... CVE-2011-4612 Fix available 5.0 MediumNovember 20, 2012
• xine xine-lib, xiph libfishsound, speex +2 more Array index vulnerability in Speex 1.1.12 and earlier, as used in libfishsound 0.9.0 and earlier,... CVE-2008-1686 Fix available 9.3 HighApril 8, 2008
• xiph icecast ezstream Multiple buffer overflows in src/ezstream.c in Ezstream before 0.3.0 allow remote attackers to... CVE-2007-1344 9.3 HighMarch 8, 2007